refactor(argocd): consolidate Applications (39→35)

Merge related Applications using multi-source pattern and PostSync hooks:

1. ingress-config ← wildcard-cert + homelab-ingress (2→1)
   - Both in k8s/bootstrap/ingress/, now use kustomization
   - Certificate deployed before Ingresses (wave 1)

2. homarr ← homarr + homarr-patches (2→1)
   - Added PostSync hook source (fix-probes-job.yaml)
   - Patches run after Helm chart deployment

3. temporal ← temporal + temporal-db-secret-sync (2→1)
   - Added PostSync hook source (copy-job.yaml)
   - DB secret sync runs after Temporal deployment

4. Removed duplicate: ingress-nginx Application
   - ingress-nginx-bootstrap (bootstrap) is working
   - Removed redundant ArgoCD-managed ingress-nginx
   - Eliminated duplicate DaemonSet

Skipped: cert-manager + cert-manager-issuers
  - Wave separation needed (CRDs before Issuers)
  - Keep separate for safety

Result: 39 → 35 Applications (-4, -10.3%)

Files:
- k8s/bootstrap/ingress/kustomization.yaml (updated)
- k8s/argocd/apps/00-substrate.yaml (merges + removal)
- k8s/argocd/apps/60-applications.yaml (merges)
- CONSOLIDATION-RESULTS.md (documentation)
- APPLICATION-CONSOLIDATION-PLAN.md (analysis)
- GITOPS-STATUS.md (updated inventory)

k8s/argocd/apps/00-substrate.yaml

@@ -34,43 +34,9 @@ spec:
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: ingress-nginx
-  namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  project: homelab
-  revisionHistoryLimit: 3
-  sources:
-    - repoURL: https://kubernetes.github.io/ingress-nginx
-      chart: ingress-nginx
-      targetRevision: "4.15.1"
-      helm:
-        valueFiles:
-          - $values/k8s/bootstrap/ingress/nginx-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
-      targetRevision: main
-      ref: values
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: ingress-nginx
-  syncPolicy:
-    managedNamespaceMetadata:
-      # hostPort 80/443 requires the privileged PodSecurity level; the default
-      # baseline/restricted enforce blocks the controller DaemonSet.
-      labels:
-        pod-security.kubernetes.io/enforce: privileged
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
+# ingress-nginx removed: duplicate of ingress-nginx-bootstrap
+# The bootstrap version (k8s/bootstrap-local/06-ingress-nginx.yaml) is kept
+# to break the circular dependency (ArgoCD needs Forgejo domain access)
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -133,10 +99,13 @@ spec:
       prune: true
       selfHeal: true
 ---
+# Consolidated: wildcard-cert + homelab-ingress → ingress-config
+# Manages both the wildcard TLS certificate and all Ingress rules.
+# Certificate must exist before Ingresses (wave 1), but both are in same directory.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: wildcard-cert
+  name: ingress-config
   namespace: argocd
   finalizers:
     - resources-finalizer.argocd.argoproj.io
@@ -149,44 +118,11 @@ spec:
     repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
     path: k8s/bootstrap/ingress
-    directory:
-      include: "riotpiao-com-cert.yaml"
   destination:
     server: https://kubernetes.default.svc
-    namespace: ingress-nginx
   syncPolicy:
     automated:
       prune: true
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
----
-# Ingress host rules for all *.riotpiao.com services (grafana, authentik,
-# forgejo, vault, minio, prometheus, etc). Previously orphaned — ingress.yaml
-# was in k8s/bootstrap/ingress but no app applied it, so the services had no
-# Ingress object and were unreachable via the LAN ingress (192.168.1.160).
-# Each object carries its own namespace; no destination.namespace override.
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: homelab-ingress
-  namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  project: homelab
-  revisionHistoryLimit: 3
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
-    targetRevision: main
-    path: k8s/bootstrap/ingress
-    directory:
-      include: "ingress.yaml"
-  destination:
-    server: https://kubernetes.default.svc
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true