feat: Terraform CI via Forgejo Actions + MinIO S3 state backend

- ArgoCD manages MinIO (phase 0), Terraform manages infrastructure
- Runner workflow: pulls state from S3, validates, plans, applies
- 34 resources imported to state, S3 backend operational
- Fixed AppProject repos, S3 endpoint deprecation, runner package manager

terraform/minio.tf

@@ -21,72 +21,10 @@ resource "kubernetes_storage_class" "longhorn_xfs" {
   }
 }
 
-resource "helm_release" "minio" {
-  name            = "minio"
-  repository      = "https://charts.min.io/"
-  chart           = "minio"
-  version         = "5.4.0"
-  namespace       = "storage"
-  upgrade_install = true
-  force_update    = true
-  wait            = true
-  timeout         = 600
-
-  values = [
-    yamlencode({
-      mode         = "standalone"
-      replicas     = 1
-      drivesPerNode = 1
-      pools        = 1
-
-      rootUser     = "minioadmin"
-      rootPassword = var.minio_root_password
-
-      persistence = {
-        enabled      = true
-        size         = "100Gi"
-        storageClass = kubernetes_storage_class.longhorn_xfs.metadata[0].name
-        accessMode   = "ReadWriteOnce"
-      }
-
-      resources = {
-        requests = {
-          memory = "512Mi"
-        }
-      }
-
-      service = {
-        type = "ClusterIP"
-        port = "9000"
-      }
-      consoleService = {
-        type = "ClusterIP"
-        port = "9001"
-      }
-
-      # Buckets auto-created on install (all-in-one, no post-hook needed)
-      buckets = [
-        { name = "terraform-state", policy = "none", purge = false },
-        { name = "vault", policy = "none", purge = false },
-        { name = "riotpiao-models", policy = "none", purge = false },
-        { name = "loki-chunks", policy = "none", purge = false },
-        { name = "loki-ruler", policy = "none", purge = false },
-        { name = "loki-admin", policy = "none", purge = false },
-        { name = "loki-index", policy = "none", purge = false },
-      ]
-
-      environment = {
-        MINIO_IDENTITY_OPENID_CONFIG_URL    = "https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration"
-        MINIO_IDENTITY_OPENID_CLIENT_ID     = "minio"
-        MINIO_IDENTITY_OPENID_CLIENT_SECRET = var.minio_oidc_client_secret
-        MINIO_IDENTITY_OPENID_CLAIM_NAME    = "policy"
-        MINIO_IDENTITY_OPENID_SCOPES        = "openid,profile,email,minio"
-        MINIO_IDENTITY_OPENID_REDIRECT_URI  = "https://minio.riotpiao.homelab.com/oauth_callback"
-        MINIO_IDENTITY_OPENID_DISPLAY_NAME  = "Authentik"
-      }
-    })
-  ]
-}
+# MinIO Helm release removed — managed by ArgoCD instead
+# Reason: MinIO is Terraform state backend (chicken-and-egg problem)
+# Solution: ArgoCD Application (k8s/argocd/apps/phase0-minio.yaml) handles deployment
+# Terraform manages everything else, state lives in MinIO (safe external backend)
 
 variable "create_storage_namespace" {
   description = "Create storage namespace if it doesn't exist"