refactor(argocd): consolidate Applications (39→35)

Merge related Applications using multi-source pattern and PostSync hooks:

1. ingress-config ← wildcard-cert + homelab-ingress (2→1)
   - Both in k8s/bootstrap/ingress/, now use kustomization
   - Certificate deployed before Ingresses (wave 1)

2. homarr ← homarr + homarr-patches (2→1)
   - Added PostSync hook source (fix-probes-job.yaml)
   - Patches run after Helm chart deployment

3. temporal ← temporal + temporal-db-secret-sync (2→1)
   - Added PostSync hook source (copy-job.yaml)
   - DB secret sync runs after Temporal deployment

4. Removed duplicate: ingress-nginx Application
   - ingress-nginx-bootstrap (bootstrap) is working
   - Removed redundant ArgoCD-managed ingress-nginx
   - Eliminated duplicate DaemonSet

Skipped: cert-manager + cert-manager-issuers
  - Wave separation needed (CRDs before Issuers)
  - Keep separate for safety

Result: 39 → 35 Applications (-4, -10.3%)

Files:
- k8s/bootstrap/ingress/kustomization.yaml (updated)
- k8s/argocd/apps/00-substrate.yaml (merges + removal)
- k8s/argocd/apps/60-applications.yaml (merges)
- CONSOLIDATION-RESULTS.md (documentation)
- APPLICATION-CONSOLIDATION-PLAN.md (analysis)
- GITOPS-STATUS.md (updated inventory)

k8s/argocd/apps/60-applications.yaml

@@ -2,33 +2,9 @@
 # helpers (cloudflared tunnel, duckdns updater) that are already running.
 # Experimental dirs (llm, forge, dev-tools, shadowsocks) are intentionally
 # NOT included yet — add them here once they're production-ready.
+# Consolidated: temporal-db-secret-sync + temporal → temporal
 # Syncs the CNPG-generated temporal-db-role Secret from ddb -> temporal ns
-# (see db-secret-sync/copy-job.yaml for why this is a separate Application
-# rather than folded into temporal/'s own kustomization). Runs one wave
-# before `temporal` so the Secret exists before the server pods start.
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: temporal-db-secret-sync
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "7"
-spec:
-  project: homelab
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
-    targetRevision: main
-    path: k8s/applications/temporal/db-secret-sync
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: temporal
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
----
+# via PostSync hook (db-secret-sync/copy-job.yaml).
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -48,6 +24,9 @@ spec:
     - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
+    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
+      targetRevision: main
+      path: k8s/applications/temporal/db-secret-sync  # PostSync hook: copy-job.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: temporal
@@ -133,6 +112,8 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
+# Consolidated: homarr + homarr-patches → homarr
+# Helm chart + values + PostSync hook patch (fix-probes-job.yaml)
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -152,6 +133,9 @@ spec:
     - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
+    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
+      targetRevision: main
+      path: k8s/applications/homarr  # PostSync hook: fix-probes-job.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: dashboard
@@ -161,25 +145,3 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: homarr-patches
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "9"  # After homarr (wave 8)
-spec:
-  project: homelab
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
-    targetRevision: main
-    path: k8s/applications/homarr
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: dashboard
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true