feat(ci): pivot to ArgoCD GitOps, fix Traefik ingress after real-cluster check

Direct SSH access to the actual clusters (node1-3 "prod" HA, dev-k8s-1-3
"dev") revealed two things that made the previous design wrong:

1. Neither cluster has vncmail/vnc-ca namespaces or a bulwark ingress at
   all - the "live sandbox" referenced in this repo's docs/manifests was
   never actually applied anywhere. Both ingress.yaml's ingressClassName
   (public) and cert-manager issuer (letsencrypt-prod) were also wrong:
   both clusters run Traefik (class is literally named `traefik`), and
   only dev-k8s has any ClusterIssuer at all (`letsencrypt-staging`).
   node1-3 has zero ClusterIssuers configured.

2. dev-k8s already has ArgoCD installed, idle, zero Applications - more
   idiomatic to use it than have GitLab Runner execute kubectl directly.

Pivots .gitlab-ci.yml: build+push image, then commit the tag into a small
per-overlay Component (overlays/{dev,prod}/image-tag/) that ArgoCD's
Application watches - CI never touches the cluster, only the registry and
this repo. dev's Application (vncmail-dev) is registered and applied
already (manual sync for now, until the one-time namespace secret
bootstrap is done - see VNCMAIL-SETUP.md). prod's Application is
scaffolded in deploy/argocd/ but deliberately not applied - it targets a
different cluster (node1-3) that isn't registered with ArgoCD yet, and
there's still no real prod hostname/Stalwart/ClusterIssuer.

Fixes base/ingress.yaml to the real ingressClassName: traefik (was the
nginx-style `public`, which doesn't exist on either cluster) and gives
each overlay its own cert-manager issuer patch instead of one hardcoded
value, since dev and prod need different (or, for prod, nonexistent)
issuers.

deploy/k8s/overlays/dev/image-tag/kustomization.yaml

@@ -0,0 +1,11 @@
+# Owned by CI (the bump-dev job in .gitlab-ci.yml), not by hand. Kept as its
+# own Component so CI only ever rewrites this 6-line file, never the parent
+# overlays/dev/kustomization.yaml (structure/patches there stay under normal
+# code review — CI regenerating a whole hand-maintained file on every push
+# would silently revert any change made there between deploys).
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+images:
+  - name: ghcr.io/brvncde-dotcom/vncmail-plus-dev
+    newName: ghcr.io/brvncde-dotcom/vncmail-plus-dev
+    newTag: latest

deploy/k8s/overlays/dev/kustomization.yaml

@@ -6,8 +6,13 @@ resources:
   - namespace.yaml
   # - secret.yaml   # create from secret.example.yaml; not committed
 
-# This is the live sandbox (vncmail.sandbox.vnc.de) — deliberately zero patches
-# beyond namespace/resource wiring, so `kubectl kustomize .` renders identical
-# to the pre-restructure flat deploy/k8s/. The image is left at base's default
-# and overridden per-deploy by CI (`kubectl set image`, see .gitlab-ci.yml's
-# deploy-dev job) rather than pinned here, so this file never goes stale.
+patches:
+  - path: patch-ingress.yaml
+
+components:
+  - image-tag
+
+# Targets the dev-k8s-1/2/3 cluster (confirmed via direct access: this is
+# where ArgoCD already lives). The image tag lives in image-tag/ (a separate
+# Component CI owns — see .gitlab-ci.yml's bump-dev job) rather than here, so
+# CI never needs to touch this file.

deploy/k8s/overlays/dev/patch-ingress.yaml

@@ -0,0 +1,27 @@
+# dev-k8s cluster confirmed to have a `letsencrypt-staging` ClusterIssuer
+# already (no `letsencrypt-prod` exists there) - staging avoids burning
+# Let's Encrypt's real rate limits while this is still being stood up.
+# vncmail.sandbox.vnc.de DNS does not point here yet either - this is the
+# intended host, not a live one (see VNCMAIL-SETUP.md for what's still open).
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vncmail-plus
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+spec:
+  tls:
+    - hosts:
+        - vncmail.sandbox.vnc.de
+      secretName: vncmail-plus-tls
+  rules:
+    - host: vncmail.sandbox.vnc.de
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vncmail-plus
+                port:
+                  number: 80