feat: initial ArgoCD GitOps self-management setup

- Base references upstream ArgoCD v3.3.6 install.yaml
- Production overlay applies all cluster customizations:
  - KSOPS CMP sidecar on argocd-repo-server
  - Custom ConfigMaps (argocd-cm, argocd-cmd-params-cm, argocd-rbac-cm, argocd-notifications-cm)
  - Redis migrated to shared-redis.data:6379
  - Traefik IngressRoute for argocd.olb42.com
  - SOPS-encrypted secrets (age key, redis auth, gitea tokens, repo-creds)
- Bootstrap Application with prune:false for safe self-management

.gitignore

@@ -0,0 +1,9 @@
+.DS_Store
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# Local plaintext twins for sync-managed secrets. Keep these untracked.
+manifest/overlays/**/secret.yaml
+manifest/components/**/secret.yaml