- Removes https:443 port from argocd-server service (redundant in insecure mode)
so K8s API proxy can resolve service endpoint without ambiguity
- Adds server.disable.auth=true to allow headlamp plugin unauthenticated API access
(external access protected by Traefik OIDC)
