Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

terraform/state.tf

@@ -1,17 +1,20 @@
+# Temporarily disabled S3 (MinIO unreachable)
+# terraform {
+#   backend "s3" {
+#     bucket                      = "terraform-state"
+#     key                         = "homelab/terraform.tfstate"
+#     region                      = "us-east-1"
+#     endpoint                    = "https://minio-api.riotpiao.homelab.com"
+#     skip_credentials_validation = true
+#     skip_requesting_account_id  = true
+#     skip_region_validation      = true
+#     use_path_style              = true
+#   }
+# }
+
+# Local backend fallback (active during MinIO outage)
 terraform {
   backend "local" {
     path = "terraform.tfstate"
   }
 }
-
-# TODO: Configure remote state (S3, GCS, or Terraform Cloud)
-# Uncomment when ready:
-# terraform {
-#   backend "s3" {
-#     bucket         = "homelab-terraform-state"
-#     key            = "prod/terraform.tfstate"
-#     region         = "us-east-1"
-#     encrypt        = true
-#     dynamodb_table = "terraform-lock"
-#   }
-# }