feat: initial ArgoCD GitOps self-management setup

- Base references upstream ArgoCD v3.3.6 install.yaml
- Production overlay applies all cluster customizations:
  - KSOPS CMP sidecar on argocd-repo-server
  - Custom ConfigMaps (argocd-cm, argocd-cmd-params-cm, argocd-rbac-cm, argocd-notifications-cm)
  - Redis migrated to shared-redis.data:6379
  - Traefik IngressRoute for argocd.olb42.com
  - SOPS-encrypted secrets (age key, redis auth, gitea tokens, repo-creds)
- Bootstrap Application with prune:false for safe self-management

manifest/overlays/production/ingressroute.yaml

@@ -0,0 +1,36 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: argocd-server
+  namespace: argocd
+  annotations:
+    gethomepage.dev/app: argocd-server
+    gethomepage.dev/description: CI Service
+    gethomepage.dev/enabled: "true"
+    gethomepage.dev/href: https://argocd.olb42.com
+    gethomepage.dev/icon: argo-cd
+    gethomepage.dev/name: Argo-CD
+    gethomepage.dev/namespace: argocd
+    gethomepage.dev/widget.key: '{{HOMEPAGE_VAR_ARGOCD_TOKEN}}'
+    gethomepage.dev/widget.type: argocd
+    gethomepage.dev/widget.url: http://argocd-server.argocd
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`argocd.olb42.com`)
+      priority: 10
+      services:
+        - name: argocd-server
+          port: 80
+          scheme: http
+    - kind: Rule
+      match: Host(`argocd.olb42.com`) && Header(`Content-Type`, `application/grpc`)
+      priority: 11
+      services:
+        - name: argocd-server
+          port: 80
+          scheme: h2c
+  tls:
+    secretName: olb42-com-tls