refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

k8s/argocd/apps/60-applications.yaml

@@ -2,7 +2,7 @@
 # helpers (cloudflared tunnel, duckdns updater) that are already running.
 # Experimental dirs (llm, forge, dev-tools, shadowsocks) are intentionally
 # NOT included yet — add them here once they're production-ready.
-# temporal using unified CNPG pattern (app user, ddb-cluster-app secret)
+# temporal using unified CNPG pattern (app user, temporal-db-app secret)
 # Secret copied by bootstrap.sh (like cicd/iam namespaces)
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -19,7 +19,7 @@ spec:
       targetRevision: "0.74.0"
       helm:
         valueFiles:
-          - $values/k8s/applications/temporal/temporal-values.yaml
+          - $values/k8s/apps/temporal/temporal-values.yaml
     - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
@@ -48,7 +48,7 @@ spec:
       targetRevision: "*"
       helm:
         valueFiles:
-          - $values/k8s/applications/portainer/portainer-values.yaml
+          - $values/k8s/apps/portainer/portainer-values.yaml
     - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
@@ -74,7 +74,7 @@ spec:
   source:
     repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
-    path: k8s/applications/cloudflared
+    path: k8s/apps/cloudflared
   destination:
     server: https://kubernetes.default.svc
     namespace: cloudflared
@@ -97,7 +97,7 @@ spec:
   source:
     repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
-    path: k8s/applications/duckdns
+    path: k8s/apps/duckdns
   destination:
     server: https://kubernetes.default.svc
     namespace: duckdns
@@ -125,13 +125,13 @@ spec:
       targetRevision: "*"
       helm:
         valueFiles:
-          - $values/k8s/applications/homarr/homarr-values.yaml
+          - $values/k8s/apps/homarr/homarr-values.yaml
     - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
     - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
-      path: k8s/applications/homarr  # PostSync hook: fix-probes-job.yaml
+      path: k8s/apps/homarr  # PostSync hook: fix-probes-job.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: dashboard