fix: use ksops generator pattern for SOPS-encrypted secrets

- Remove configmap.enc.yaml from resources (blocked kustomize parsing)
- Create secret-generator.yaml with ksops exec plugin config
- ksops decrypts secrets before kustomize reads them
- Allows Image Updater to safely edit images section
- Fixes: ArgoCD repo-server now properly decrypts secrets via ksops plugin

Pattern mirrors homelab/k8s/argocd/secrets/ for consistency

infra/portfolio/base/kustomization.yaml

@@ -1,17 +1,22 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: portfolio
+
 resources:
 - namespace.yaml
-- configmap.enc.yaml
 - deployment.yaml
 - service.yaml
 - ingress.yaml
 
+# SOPS-encrypted secrets via ksops generator (ArgoCD repo-server plugin)
+# ksops intercepts encrypted files, decrypts them, returns valid resources
+generatorOptions:
+  disableNameSuffixHash: true
+
+generators:
+  - secret-generator.yaml
+
 # ArgoCD Image Updater configuration - for tag updates
 images:
 - name: forgejo.riotpiao.com/rock/portfolio
   newTag: latest
-
-# Note: SOPS decryption is handled by ArgoCD repo-server plugin,
-# not via kustomization.yaml, to allow Image Updater to parse this file