Substrate had no owner since Terraform was deleted (Pure GitOps). Adds 5 wave-0/1 Applications: cert-manager v1.21.0 (installCRDs, CP tolerations), ingress-nginx 4.15.1 (LB 192.168.1.160), reloader 2.2.14 at wave 0; LE ClusterIssuers + *.riotpiao.com wildcard cert at wave 1 (DNS-01 via Cloudflare). Adds 3 chart repos to AppProject sourceRepos and SOPS-encrypted cloudflare-api-token secret. Cert starts on letsencrypt-staging; flip to prod after clean issue.