Migrate k8s config from Terraform to Argo CD + ESO

Phase 1: Install External Secrets Operator via Argo CD app
- apps/external-secrets.yaml — ESO Helm chart install
- apps/external-secrets-config.yaml — ClusterSecretStore deployment
- k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret

Phase 2: Create k8s manifests for all services
- k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress
- k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress
- k8s/github-runner/ — ExternalSecret (github-runner-secret)
- k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret)
- k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress
- k8s/postgres/ — ExternalSecret (postgres-passwords)
- k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault)
- k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret
- k8s/ollama/ — PVC, Ingress
- k8s/headscale/ — PVC
- k8s/packages/ — PVCs, ConfigMap, Ingresses
- k8s/registry/ — PVC, Ingresses
- k8s/backup/ — CronJob, ExternalSecret (backup-credentials)

New Argo CD apps for Helm releases:
- apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml
- apps/postgres.yaml, redis.yaml, vault.yaml

New Argo CD apps for k8s config paths:
- apps/neuron-config, gitea-config, ci-config, gitea-runner-config
- apps/monitoring-config, adguard-config, ollama-config, headscale-config
- apps/packages-config, registry-config, postgres-config, vault-config, backup

Phase 3: Strip Terraform to infrastructure-only
- All kubernetes_* and helm_release resources removed from service .tf files
- Each service .tf now contains only kubernetes_namespace (bootstrap dependency)
- variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token
- namespaces.tf gains external-secrets namespace
- ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/)
- cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)

servers/legion/k8s/gitea/configmap.yaml

@@ -0,0 +1,104 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-custom-css
+  namespace: git
+data:
+  header.tmpl: |
+    <link rel="stylesheet" href="/assets/css/custom.css">
+  custom.css: |
+    /* ── Typography & base ── */
+    :root {
+      --color-primary: #6366f1;
+      --color-primary-dark: #4f46e5;
+      --color-secondary: #8b5cf6;
+      --color-bg: #0f0f17;
+      --color-surface: #16161f;
+      --color-surface-2: #1e1e2e;
+      --color-border: #2a2a3d;
+      --color-text: #e2e2f0;
+      --color-text-muted: #8888aa;
+      --color-green: #22d3a5;
+      --radius: 10px;
+    }
+
+    body {
+      background: var(--color-bg) !important;
+      color: var(--color-text) !important;
+      font-family: "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif !important;
+    }
+
+    /* ── Top navbar ── */
+    .navbar, #navbar {
+      background: var(--color-surface) !important;
+      border-bottom: 1px solid var(--color-border) !important;
+      box-shadow: 0 1px 12px rgba(0,0,0,0.4) !important;
+    }
+
+    .navbar .brand svg, .navbar .brand img { filter: brightness(1.2); }
+
+    /* ── Sidebar & panels ── */
+    .repository, .ui.container, .ui.segment,
+    .ui.card, .ui.cards > .card {
+      background: var(--color-surface) !important;
+      border: 1px solid var(--color-border) !important;
+      border-radius: var(--radius) !important;
+    }
+
+    /* ── Buttons ── */
+    .ui.primary.button, .ui.green.button {
+      background: var(--color-primary) !important;
+      border: none !important;
+      border-radius: 8px !important;
+    }
+    .ui.primary.button:hover { background: var(--color-primary-dark) !important; }
+
+    /* ── Inputs ── */
+    input, textarea, select,
+    .ui.input > input, .ui.dropdown {
+      background: var(--color-surface-2) !important;
+      border: 1px solid var(--color-border) !important;
+      color: var(--color-text) !important;
+      border-radius: 8px !important;
+    }
+
+    /* ── Sign-in page ── */
+    .user.signin .ui.segment,
+    .user.signup .ui.segment {
+      background: var(--color-surface) !important;
+      border: 1px solid var(--color-border) !important;
+      border-radius: 16px !important;
+      box-shadow: 0 8px 32px rgba(0,0,0,0.5) !important;
+      padding: 2.5rem !important;
+    }
+
+    /* ── Repo file tree ── */
+    .repository.file.list .file-list {
+      background: var(--color-surface) !important;
+      border-radius: var(--radius) !important;
+      border: 1px solid var(--color-border) !important;
+    }
+
+    .repository.file.list .file-list tr:hover td {
+      background: var(--color-surface-2) !important;
+    }
+
+    /* ── Labels & badges ── */
+    .ui.label { border-radius: 6px !important; }
+
+    /* ── Dashboard activity feed ── */
+    .feeds .news { border-bottom: 1px solid var(--color-border) !important; }
+
+    /* ── Code blocks ── */
+    pre, code {
+      background: var(--color-surface-2) !important;
+      border: 1px solid var(--color-border) !important;
+      border-radius: 6px !important;
+    }
+
+    /* ── Muted footer ── */
+    #footer {
+      background: var(--color-surface) !important;
+      border-top: 1px solid var(--color-border) !important;
+      color: var(--color-text-muted) !important;
+    }