fix: remove argocd-server https port and disable auth for headlamp plugin

- Removes https:443 port from argocd-server service (redundant in insecure mode)
  so K8s API proxy can resolve service endpoint without ambiguity
- Adds server.disable.auth=true to allow headlamp plugin unauthenticated API access
  (external access protected by Traefik OIDC)

manifest/overlays/production/argocd-cmd-params-cm-patch.yaml

@@ -6,3 +6,4 @@ metadata:
 data:
   redis.server: shared-redis.data:6379
   server.insecure: "true"
+  server.disable.auth: "true"

manifest/overlays/production/argocd-server-service-patch.yaml

@@ -0,0 +1,7 @@
+- op: replace
+  path: /spec/ports
+  value:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: 8080

manifest/overlays/production/kustomization.yaml

@@ -23,6 +23,10 @@ patches:
   - path: argocd-notifications-cm-patch.yaml
   - path: repo-server-patch.yaml
   - path: disable-bundled-redis-patch.yaml
+  - path: argocd-server-service-patch.yaml
+    target:
+      kind: Service
+      name: argocd-server
 
 # # KSOPS decrypts secret.enc.yaml at render time.
 # # The presence of ksops-generator.yaml activates the KSOPS CMP plugin.