Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

terraform/bootstrap-manifests.yaml

@@ -0,0 +1,80 @@
+---
+# ClusterIssuer: selfsigned-bootstrap (initial issuer for homelab-ca cert)
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-bootstrap
+spec:
+  selfSigned: {}
+
+---
+# ClusterIssuer: homelab-ca (uses generated homelab-ca cert)
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: homelab-ca
+spec:
+  ca:
+    secretName: homelab-ca-secret
+
+---
+# Self-signed CA certificate (10 year lifetime)
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: homelab-ca
+  namespace: cert-manager
+spec:
+  commonName: homelab-ca
+  duration: 87600h
+  isCA: true
+  issuerRef:
+    kind: ClusterIssuer
+    name: selfsigned-bootstrap
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  renewBefore: 720h
+  secretName: homelab-ca-secret
+
+---
+# Wildcard TLS certificate for *.riotpiao.homelab.com
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: homelab-tls
+  namespace: ingress-nginx
+spec:
+  commonName: "*.riotpiao.homelab.com"
+  dnsNames:
+    - "*.riotpiao.homelab.com"
+  duration: 2160h
+  issuerRef:
+    kind: ClusterIssuer
+    name: homelab-ca
+  renewBefore: 720h
+  secretName: homelab-tls
+
+---
+# ArgoCD namespace
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: argocd
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: latest
+
+---
+# dev-tools namespace
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dev-tools
+  labels:
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: latest
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest