Migrate k8s config from Terraform to Argo CD + ESO

Phase 1: Install External Secrets Operator via Argo CD app
- apps/external-secrets.yaml — ESO Helm chart install
- apps/external-secrets-config.yaml — ClusterSecretStore deployment
- k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret

Phase 2: Create k8s manifests for all services
- k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress
- k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress
- k8s/github-runner/ — ExternalSecret (github-runner-secret)
- k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret)
- k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress
- k8s/postgres/ — ExternalSecret (postgres-passwords)
- k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault)
- k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret
- k8s/ollama/ — PVC, Ingress
- k8s/headscale/ — PVC
- k8s/packages/ — PVCs, ConfigMap, Ingresses
- k8s/registry/ — PVC, Ingresses
- k8s/backup/ — CronJob, ExternalSecret (backup-credentials)

New Argo CD apps for Helm releases:
- apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml
- apps/postgres.yaml, redis.yaml, vault.yaml

New Argo CD apps for k8s config paths:
- apps/neuron-config, gitea-config, ci-config, gitea-runner-config
- apps/monitoring-config, adguard-config, ollama-config, headscale-config
- apps/packages-config, registry-config, postgres-config, vault-config, backup

Phase 3: Strip Terraform to infrastructure-only
- All kubernetes_* and helm_release resources removed from service .tf files
- Each service .tf now contains only kubernetes_namespace (bootstrap dependency)
- variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token
- namespaces.tf gains external-secrets namespace
- ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/)
- cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)

servers/legion/vault.tf

@@ -1,6 +1,8 @@
-# Vault — secrets management with GCP KMS auto-unseal
-# UI: https://vault.neuralplatform.ai
-# Auto-unseal: GCP KMS projects/neuron-785695/locations/global/keyRings/vault/cryptoKeys/vault-unseal
+# Vault — namespace only
+# Helm release and GCP SA secret managed by Argo CD + ESO
+# See: apps/vault.yaml, apps/vault-config.yaml, k8s/vault/
+# Note: vault-gcp-sa.json must be stored in Vault at secret/vault-gcp-sa (sa_json field)
+# before the ESO ExternalSecret can sync it.
 
 resource "kubernetes_namespace" "vault" {
   metadata {
@@ -11,99 +13,3 @@ resource "kubernetes_namespace" "vault" {
     }
   }
 }
-
-resource "kubernetes_secret" "vault_gcp_sa" {
-  metadata {
-    name      = "vault-gcp-sa"
-    namespace = kubernetes_namespace.vault.metadata[0].name
-  }
-
-  data = {
-    "sa.json" = file("${path.module}/vault-gcp-sa.json")
-  }
-}
-
-resource "helm_release" "vault" {
-  name       = "vault"
-  namespace  = kubernetes_namespace.vault.metadata[0].name
-  repository = "https://helm.releases.hashicorp.com"
-  chart      = "vault"
-  version    = "0.29.1"
-  timeout    = 300
-
-  values = [<<-EOT
-    server:
-      image:
-        repository: hashicorp/vault
-        tag: "1.18.3"
-
-      extraEnvironmentVars:
-        GOOGLE_APPLICATION_CREDENTIALS: /vault/gcp/sa.json
-
-      volumes:
-        - name: gcp-sa
-          secret:
-            secretName: vault-gcp-sa
-
-      volumeMounts:
-        - name: gcp-sa
-          mountPath: /vault/gcp
-          readOnly: true
-
-      ha:
-        enabled: false
-
-      dataStorage:
-        enabled: true
-        size: 10Gi
-
-      standalone:
-        enabled: true
-        config: |
-          ui = true
-
-          listener "tcp" {
-            tls_disable = 1
-            address     = "[::]:8200"
-            cluster_address = "[::]:8201"
-          }
-
-          storage "file" {
-            path = "/vault/data"
-          }
-
-          seal "gcpckms" {
-            project    = "neuron-785695"
-            region     = "global"
-            key_ring   = "vault"
-            crypto_key = "vault-unseal"
-          }
-
-      ingress:
-        enabled: true
-        ingressClassName: traefik
-        annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-        hosts:
-          - host: vault.${var.infra_domain}
-            paths:
-              - /
-        tls:
-          - secretName: vault-tls
-            hosts:
-              - vault.${var.infra_domain}
-
-    ui:
-      enabled: true
-
-    injector:
-      enabled: false
-  EOT
-  ]
-
-  depends_on = [
-    kubernetes_secret.vault_gcp_sa,
-    helm_release.cert_manager,
-  ]
-}