feat(ci): pivot to ArgoCD GitOps, fix Traefik ingress after real-cluster check

Direct SSH access to the actual clusters (node1-3 "prod" HA, dev-k8s-1-3
"dev") revealed two things that made the previous design wrong:

1. Neither cluster has vncmail/vnc-ca namespaces or a bulwark ingress at
   all - the "live sandbox" referenced in this repo's docs/manifests was
   never actually applied anywhere. Both ingress.yaml's ingressClassName
   (public) and cert-manager issuer (letsencrypt-prod) were also wrong:
   both clusters run Traefik (class is literally named `traefik`), and
   only dev-k8s has any ClusterIssuer at all (`letsencrypt-staging`).
   node1-3 has zero ClusterIssuers configured.

2. dev-k8s already has ArgoCD installed, idle, zero Applications - more
   idiomatic to use it than have GitLab Runner execute kubectl directly.

Pivots .gitlab-ci.yml: build+push image, then commit the tag into a small
per-overlay Component (overlays/{dev,prod}/image-tag/) that ArgoCD's
Application watches - CI never touches the cluster, only the registry and
this repo. dev's Application (vncmail-dev) is registered and applied
already (manual sync for now, until the one-time namespace secret
bootstrap is done - see VNCMAIL-SETUP.md). prod's Application is
scaffolded in deploy/argocd/ but deliberately not applied - it targets a
different cluster (node1-3) that isn't registered with ArgoCD yet, and
there's still no real prod hostname/Stalwart/ClusterIssuer.

Fixes base/ingress.yaml to the real ingressClassName: traefik (was the
nginx-style `public`, which doesn't exist on either cluster) and gives
each overlay its own cert-manager issuer patch instead of one hardcoded
value, since dev and prod need different (or, for prod, nonexistent)
issuers.

deploy/argocd/vncmail-dev-app.yaml

@@ -0,0 +1,29 @@
+# Registered on the dev-k8s-1/2/3 cluster (where ArgoCD already lives) via
+# `kubectl apply` directly to the argocd namespace — this file is the
+# version-controlled record of that, not something ArgoCD itself syncs
+# (no app-of-apps here, deliberately kept simple for two Applications).
+#
+# syncPolicy starts WITHOUT automated — manual sync until the one-time
+# per-namespace bootstrap (vncmail-env secret, image-pull secret — see
+# deploy/k8s/README.md §3) is done by hand once. Flip to automated (see
+# commented block below) only after a first manual sync succeeds cleanly.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vncmail-dev
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: git@gitlab.vnc.biz:gitlab-instance-b9b5cf2f/vncmail-plus.git
+    targetRevision: dev
+    path: deploy/k8s/overlays/dev
+  destination:
+    server: https://kubernetes.default.svc # in-cluster — ArgoCD and vncmail-dev share this cluster
+    namespace: vncmail
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    # automated:
+    #   prune: true
+    #   selfHeal: true