A1: Replace per-repo Forgejo entries with https://forgejo.riotpiao.com/rock/* wildcard so onboarding never requires touching AppProject. A2: Add wave -1 Application for k8s/argocd/projects/ so it syncs before any Application references the AppProject. Also add kustomization.yaml to k8s/argocd/projects/ to make it renderable. Enabled by Stage 1 (A1, A2).