Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

terraform/providers.tf

@@ -9,6 +9,10 @@ terraform {
       source  = "hashicorp/helm"
       version = "~> 2.14"
     }
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.0"
+    }
     null = {
       source  = "hashicorp/null"
       version = "~> 3.2"
@@ -25,3 +29,8 @@ provider "helm" {
     config_path = var.kubeconfig_path
   }
 }
+
+provider "vault" {
+  address         = "https://vault.riotpiao.homelab.com"
+  skip_tls_verify = true
+}