Migrate all app deployments from Terraform to Argo CD

Move gitea, github-runner, neuron, cloudflared, ollama, verdaccio,
devpi, registry, and registry-ui deployments+services to apps/*.yaml
so Argo CD manages the app layer. Terraform retains namespaces, PVCs,
ConfigMaps, Secrets, and Ingresses.

New Secrets in Terraform:
- kubernetes_secret.github_runner_secret (ci/github-runner-secret)
- kubernetes_secret.cloudflared_secret (neuron/cloudflared-secret)

Hardcoded service names in ingress.tf and neuron.tf to remove
dependency on removed kubernetes_service resources.

servers/legion/registry.tf

@@ -25,159 +25,4 @@ resource "kubernetes_persistent_volume_claim" "registry_data" {
   }
 }
 
-resource "kubernetes_deployment" "registry" {
-  metadata {
-    name      = "registry"
-    namespace = kubernetes_namespace.registry.metadata[0].name
-    labels = {
-      app = "registry"
-    }
-  }
-
-  spec {
-    replicas = 1
-
-    selector {
-      match_labels = {
-        app = "registry"
-      }
-    }
-
-    template {
-      metadata {
-        labels = {
-          app = "registry"
-        }
-      }
-
-      spec {
-        container {
-          name  = "registry"
-          image = "registry:2"
-
-          port {
-            container_port = 5000
-          }
-
-          volume_mount {
-            name       = "data"
-            mount_path = "/var/lib/registry"
-          }
-
-          resources {
-            requests = {
-              memory = "64Mi"
-              cpu    = "50m"
-            }
-            limits = {
-              memory = "256Mi"
-              cpu    = "200m"
-            }
-          }
-        }
-
-        volume {
-          name = "data"
-          persistent_volume_claim {
-            claim_name = kubernetes_persistent_volume_claim.registry_data.metadata[0].name
-          }
-        }
-      }
-    }
-  }
-}
-
-resource "kubernetes_service" "registry" {
-  metadata {
-    name      = "registry"
-    namespace = kubernetes_namespace.registry.metadata[0].name
-  }
-
-  spec {
-    selector = { app = "registry" }
-    port {
-      port        = 5000
-      target_port = 5000
-    }
-    type = "ClusterIP"
-  }
-}
-
-# Docker Registry UI — browse images and tags visually
-resource "kubernetes_deployment" "registry_ui" {
-  metadata {
-    name      = "registry-ui"
-    namespace = kubernetes_namespace.registry.metadata[0].name
-    labels    = { app = "registry-ui" }
-  }
-
-  spec {
-    replicas = 1
-    selector {
-      match_labels = { app = "registry-ui" }
-    }
-    template {
-      metadata {
-        labels = { app = "registry-ui" }
-      }
-      spec {
-        container {
-          name  = "registry-ui"
-          image = "joxit/docker-registry-ui:latest"
-
-          port {
-            container_port = 80
-          }
-
-          env {
-            name  = "REGISTRY_TITLE"
-            value = "Nook Registry"
-          }
-          env {
-            name  = "NGINX_PROXY_PASS_URL"
-            value = "http://registry:5000"
-          }
-          env {
-            name  = "SINGLE_REGISTRY"
-            value = "true"
-          }
-          env {
-            name  = "SHOW_CONTENT_DIGEST"
-            value = "true"
-          }
-          env {
-            name  = "DELETE_IMAGES"
-            value = "true"
-          }
-
-          resources {
-            requests = {
-              memory = "32Mi"
-              cpu    = "20m"
-            }
-            limits = {
-              memory = "64Mi"
-              cpu    = "100m"
-            }
-          }
-        }
-      }
-    }
-  }
-}
-
-resource "kubernetes_service" "registry_ui" {
-  metadata {
-    name      = "registry-ui"
-    namespace = kubernetes_namespace.registry.metadata[0].name
-  }
-
-  spec {
-    selector = { app = "registry-ui" }
-    port {
-      port        = 80
-      target_port = 80
-    }
-    type = "ClusterIP"
-  }
-}
+# Deployments + Services managed by Argo CD — see servers/legion/apps/registry.yaml