feat: initial ArgoCD GitOps self-management setup

- Base references upstream ArgoCD v3.3.6 install.yaml
- Production overlay applies all cluster customizations:
  - KSOPS CMP sidecar on argocd-repo-server
  - Custom ConfigMaps (argocd-cm, argocd-cmd-params-cm, argocd-rbac-cm, argocd-notifications-cm)
  - Redis migrated to shared-redis.data:6379
  - Traefik IngressRoute for argocd.olb42.com
  - SOPS-encrypted secrets (age key, redis auth, gitea tokens, repo-creds)
- Bootstrap Application with prune:false for safe self-management

manifest/overlays/production/kustomization.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: argocd
+
+resources:
+  - ../../base
+  - argocd-cmp-cm.yaml
+  - ksops-cmp-config.yaml
+  - ingressroute.yaml
+
+patches:
+  - path: argocd-cm-patch.yaml
+  - path: argocd-cmd-params-cm-patch.yaml
+  - path: argocd-rbac-cm-patch.yaml
+  - path: argocd-notifications-cm-patch.yaml
+  - path: repo-server-patch.yaml
+
+# KSOPS decrypts secret.enc.yaml at render time.
+# The presence of ksops-generator.yaml activates the KSOPS CMP plugin.
+generators:
+  - ksops-generator.yaml