Migrate k8s config from Terraform to Argo CD + ESO

Phase 1: Install External Secrets Operator via Argo CD app
- apps/external-secrets.yaml — ESO Helm chart install
- apps/external-secrets-config.yaml — ClusterSecretStore deployment
- k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret

Phase 2: Create k8s manifests for all services
- k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress
- k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress
- k8s/github-runner/ — ExternalSecret (github-runner-secret)
- k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret)
- k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress
- k8s/postgres/ — ExternalSecret (postgres-passwords)
- k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault)
- k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret
- k8s/ollama/ — PVC, Ingress
- k8s/headscale/ — PVC
- k8s/packages/ — PVCs, ConfigMap, Ingresses
- k8s/registry/ — PVC, Ingresses
- k8s/backup/ — CronJob, ExternalSecret (backup-credentials)

New Argo CD apps for Helm releases:
- apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml
- apps/postgres.yaml, redis.yaml, vault.yaml

New Argo CD apps for k8s config paths:
- apps/neuron-config, gitea-config, ci-config, gitea-runner-config
- apps/monitoring-config, adguard-config, ollama-config, headscale-config
- apps/packages-config, registry-config, postgres-config, vault-config, backup

Phase 3: Strip Terraform to infrastructure-only
- All kubernetes_* and helm_release resources removed from service .tf files
- Each service .tf now contains only kubernetes_namespace (bootstrap dependency)
- variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token
- namespaces.tf gains external-secrets namespace
- ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/)
- cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)

servers/legion/packages.tf

@@ -1,5 +1,6 @@
-# Package registries — Verdaccio (npm) and devpi (PyPI)
-# Both proxy to public registries and cache locally on Legion
+# Package registries — namespace only
+# PVCs, ConfigMap, Ingresses managed by Argo CD
+# See: apps/packages.yaml, apps/packages-config.yaml, k8s/packages/
 
 resource "kubernetes_namespace" "packages" {
   metadata {
@@ -10,69 +11,3 @@ resource "kubernetes_namespace" "packages" {
     }
   }
 }
-
-resource "kubernetes_persistent_volume_claim" "verdaccio_data" {
-  metadata {
-    name      = "verdaccio-data"
-    namespace = kubernetes_namespace.packages.metadata[0].name
-  }
-  spec {
-    access_modes = ["ReadWriteOnce"]
-    resources {
-      requests = { storage = "10Gi" }
-    }
-  }
-}
-
-resource "kubernetes_persistent_volume_claim" "devpi_data" {
-  metadata {
-    name      = "devpi-data"
-    namespace = kubernetes_namespace.packages.metadata[0].name
-  }
-  spec {
-    access_modes = ["ReadWriteOnce"]
-    resources {
-      requests = { storage = "10Gi" }
-    }
-  }
-}
-
-# Verdaccio — npm proxy/cache
-resource "kubernetes_config_map" "verdaccio_config" {
-  metadata {
-    name      = "verdaccio-config"
-    namespace = kubernetes_namespace.packages.metadata[0].name
-  }
-
-  data = {
-    "config.yaml" = <<-EOT
-      storage: /verdaccio/storage
-      auth:
-        htpasswd:
-          file: /verdaccio/storage/htpasswd
-          max_users: 1
-      uplinks:
-        npmjs:
-          url: https://registry.npmjs.org/
-          cache: true
-      packages:
-        '@harmonic-framework/*':
-          access: $authenticated
-          publish: $authenticated
-          unpublish: $authenticated
-        '**':
-          access: $all
-          publish: $authenticated
-          proxy: npmjs
-      listen: 0.0.0.0:4873
-      server:
-        keepAliveTimeout: 60
-      log:
-        type: stdout
-        format: pretty
-        level: http
-    EOT
-  }
-}
-
-# Deployments + Services managed by Argo CD — see servers/legion/apps/packages.yaml