feat(phase4): ArgoCD-driven Terraform apply via PostSync Hook Job

- Create Phase 4 ArgoCD Application (terraform-apply)
- PostSync Hook Job runs: terraform init && terraform apply -auto-approve
- ServiceAccount + ClusterRole for cluster-admin RBAC
- S3 credentials encrypted with SOPS (terraform-s3-secrets.enc.yaml)
- Pre-commit hook blocks local 'terraform apply' — all changes via git push
- True IaC: modify terraform/*.tf → git push → ArgoCD applies automatically

terraform/argocd-bootstrap.tf

@@ -96,7 +96,7 @@ resource "helm_release" "argocd" {
           {
             name  = "GIT_SSL_CAINFO"
             value = "/etc/ssl/certs/homelab-ca.crt"
-          }
+          },
           {
             name  = "SOPS_AGE_KEY_FILE"
             value = "/home/argocd/.sops/keys.txt"
@@ -108,7 +108,7 @@ resource "helm_release" "argocd" {
             secret = {
               secretName = "homelab-ca-secret"
             }
-          }
+          },
           {
             name = "sops-age"
             secret = {
@@ -122,7 +122,7 @@ resource "helm_release" "argocd" {
             name      = "homelab-ca"
             mountPath = "/etc/ssl/certs/homelab-ca.crt"
             subPath   = "tls.crt"
-          }
+          },
           {
             name      = "sops-age"
             mountPath = "/home/argocd/.sops"