fix: remove argocd-server https port and disable auth for headlamp plugin

- Removes https:443 port from argocd-server service (redundant in insecure mode)
  so K8s API proxy can resolve service endpoint without ambiguity
- Adds server.disable.auth=true to allow headlamp plugin unauthenticated API access
  (external access protected by Traefik OIDC)

manifest/overlays/production/kustomization.yaml

@@ -23,6 +23,10 @@ patches:
   - path: argocd-notifications-cm-patch.yaml
   - path: repo-server-patch.yaml
   - path: disable-bundled-redis-patch.yaml
+  - path: argocd-server-service-patch.yaml
+    target:
+      kind: Service
+      name: argocd-server
 
 # # KSOPS decrypts secret.enc.yaml at render time.
 # # The presence of ksops-generator.yaml activates the KSOPS CMP plugin.