Migrate k8s config from Terraform to Argo CD + ESO

Phase 1: Install External Secrets Operator via Argo CD app
- apps/external-secrets.yaml — ESO Helm chart install
- apps/external-secrets-config.yaml — ClusterSecretStore deployment
- k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret

Phase 2: Create k8s manifests for all services
- k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress
- k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress
- k8s/github-runner/ — ExternalSecret (github-runner-secret)
- k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret)
- k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress
- k8s/postgres/ — ExternalSecret (postgres-passwords)
- k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault)
- k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret
- k8s/ollama/ — PVC, Ingress
- k8s/headscale/ — PVC
- k8s/packages/ — PVCs, ConfigMap, Ingresses
- k8s/registry/ — PVC, Ingresses
- k8s/backup/ — CronJob, ExternalSecret (backup-credentials)

New Argo CD apps for Helm releases:
- apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml
- apps/postgres.yaml, redis.yaml, vault.yaml

New Argo CD apps for k8s config paths:
- apps/neuron-config, gitea-config, ci-config, gitea-runner-config
- apps/monitoring-config, adguard-config, ollama-config, headscale-config
- apps/packages-config, registry-config, postgres-config, vault-config, backup

Phase 3: Strip Terraform to infrastructure-only
- All kubernetes_* and helm_release resources removed from service .tf files
- Each service .tf now contains only kubernetes_namespace (bootstrap dependency)
- variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token
- namespaces.tf gains external-secrets namespace
- ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/)
- cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)

servers/legion/ddclient.tf

@@ -1,73 +1,3 @@
-# ddclient — dynamic DNS daemon that keeps dot.nook.family pointing at the home public IP
-# Updates Cloudflare A record every 5 minutes; required for DoT (port 853) which can't use Cloudflare proxy
-
-resource "kubernetes_secret" "ddclient_config" {
-  metadata {
-    name      = "ddclient-config"
-    namespace = kubernetes_namespace.dns.metadata[0].name
-  }
-
-  data = {
-    "ddclient.conf" = <<-EOT
-      daemon=300
-      syslog=yes
-      pid=/var/run/ddclient/ddclient.pid
-      use=web, web=https://api.ipify.org
-
-      protocol=cloudflare
-      zone=nook.family
-      ttl=120
-      login=${var.cloudflare_email}
-      password=${var.cloudflare_api_key}
-      dot.nook.family
-    EOT
-  }
-}
-
-resource "kubernetes_deployment" "ddclient" {
-  metadata {
-    name      = "ddclient"
-    namespace = kubernetes_namespace.dns.metadata[0].name
-    labels    = { app = "ddclient" }
-  }
-
-  spec {
-    replicas = 1
-    selector {
-      match_labels = { app = "ddclient" }
-    }
-    template {
-      metadata {
-        labels = { app = "ddclient" }
-      }
-      spec {
-        container {
-          name    = "ddclient"
-          image   = "ghcr.io/ddclient/ddclient:latest"
-          command = ["ddclient", "-file", "/etc/ddclient/ddclient.conf", "-daemon", "300", "-noquiet", "-foreground"]
-
-          volume_mount {
-            name       = "config"
-            mount_path = "/etc/ddclient/ddclient.conf"
-            sub_path   = "ddclient.conf"
-            read_only  = true
-          }
-
-          resources {
-            requests = { memory = "32Mi", cpu = "10m" }
-            limits   = { memory = "64Mi" }
-          }
-        }
-
-        volume {
-          name = "config"
-          secret {
-            secret_name = kubernetes_secret.ddclient_config.metadata[0].name
-          }
-        }
-      }
-    }
-  }
-
-  depends_on = [kubernetes_namespace.dns]
-}
+# ddclient — dynamic DNS daemon
+# Deployment and config secret managed by Argo CD + ESO
+# See: apps/adguard-config.yaml, k8s/adguard/ddclient-*.yaml