Migrate k8s config from Terraform to Argo CD + ESO

Phase 1: Install External Secrets Operator via Argo CD app
- apps/external-secrets.yaml — ESO Helm chart install
- apps/external-secrets-config.yaml — ClusterSecretStore deployment
- k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret

Phase 2: Create k8s manifests for all services
- k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress
- k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress
- k8s/github-runner/ — ExternalSecret (github-runner-secret)
- k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret)
- k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress
- k8s/postgres/ — ExternalSecret (postgres-passwords)
- k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault)
- k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret
- k8s/ollama/ — PVC, Ingress
- k8s/headscale/ — PVC
- k8s/packages/ — PVCs, ConfigMap, Ingresses
- k8s/registry/ — PVC, Ingresses
- k8s/backup/ — CronJob, ExternalSecret (backup-credentials)

New Argo CD apps for Helm releases:
- apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml
- apps/postgres.yaml, redis.yaml, vault.yaml

New Argo CD apps for k8s config paths:
- apps/neuron-config, gitea-config, ci-config, gitea-runner-config
- apps/monitoring-config, adguard-config, ollama-config, headscale-config
- apps/packages-config, registry-config, postgres-config, vault-config, backup

Phase 3: Strip Terraform to infrastructure-only
- All kubernetes_* and helm_release resources removed from service .tf files
- Each service .tf now contains only kubernetes_namespace (bootstrap dependency)
- variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token
- namespaces.tf gains external-secrets namespace
- ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/)
- cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)

servers/legion/variables.tf

@@ -11,7 +11,7 @@ variable "legion_ip" {
 }
 
 variable "domain_suffix" {
-  description = "Internal-only domain (nook.family) — not exposed via Cloudflare tunnel. Use infra_domain for public services."
+  description = "Internal-only domain (nook.family)"
   type        = string
   default     = "nook.family"
 }
@@ -34,116 +34,8 @@ variable "cloudflare_email" {
   default     = "andersonwilliam85@gmail.com"
 }
 
-variable "gitea_domain" {
-  description = "Domain for Gitea git server"
-  type        = string
-  default     = "git.neuralplatform.ai"
-}
-
-variable "gitea_admin_password" {
-  description = "Gitea admin user password"
-  type        = string
-  sensitive   = true
-}
-
-variable "gitea_db_password" {
-  description = "Gitea database password"
-  type        = string
-  sensitive   = true
-}
-
-variable "postgres_password" {
-  description = "Postgres superuser password"
-  type        = string
-  sensitive   = true
-}
-
-variable "kong_db_password" {
-  description = "Kong database password"
-  type        = string
-  sensitive   = true
-}
-
-variable "grafana_admin_password" {
-  description = "Grafana admin password"
-  type        = string
-  sensitive   = true
-}
-
-variable "github_classic_pat" {
-  description = "GitHub classic PAT with admin:org scope for runner registration"
-  type        = string
-  sensitive   = true
-}
-
-variable "github_org" {
-  description = "GitHub organization"
-  type        = string
-  default     = "harmonic-framework"
-}
-
-variable "r2_endpoint" {
-  description = "Cloudflare R2 S3-compatible endpoint"
-  type        = string
-  default     = "https://651161e0a3d321561b4c90b5bcd5f15b.r2.cloudflarestorage.com"
-}
-
-variable "r2_access_key_id" {
-  description = "Cloudflare R2 access key ID"
-  type        = string
-  sensitive   = true
-}
-
-variable "r2_secret_access_key" {
-  description = "Cloudflare R2 secret access key"
-  type        = string
-  sensitive   = true
-}
-
-variable "cloudflared_tunnel_token" {
-  description = "Cloudflare tunnel token for neural-platform tunnel"
-  type        = string
-  sensitive   = true
-}
-
-variable "slack_bot_token" {
-  description = "Slack bot token for Neuron bot"
-  type        = string
-  sensitive   = true
-}
-
-variable "slack_signing_secret" {
-  description = "Slack signing secret for webhook verification"
-  type        = string
-  sensitive   = true
-}
-
-variable "github_webhook_secret" {
-  description = "GitHub webhook secret for Axon event ingestion"
-  type        = string
-  sensitive   = true
-}
-
-variable "gitea_webhook_secret" {
-  description = "Gitea webhook secret for Axon event ingestion"
-  type        = string
-  sensitive   = true
-}
-
 variable "gitea_api_token" {
   description = "Gitea API token for Argo CD repo access"
   type        = string
   sensitive   = true
 }
-
-variable "gitea_runner_token" {
-  description = "Gitea act-runner registration token"
-  type        = string
-  sensitive   = true
-}
-
-variable "alloy_push_token" {
-  description = "Bearer token required to push OTLP logs/traces to alloy.neuralplatform.ai"
-  type        = string
-  sensitive   = true
-}