ci: split GitOps state into cloud-host-gitops repo, add Sealed Secrets, fix pipeline auth

- Workflow now pushes image tags to the separate cloud-host-gitops repo
  (no more CI loop risk) and authenticates via CI_TOKEN secret
- Fix undefined ${REGISTRY} in Kaniko jobs, add concurrency group,
  targeted tag update, and mounted kaniko-harbor-auth docker config
- Argo CD Application is now multi-source (chart from cloud-host,
  values from cloud-host-gitops)
- Remove plaintext runner token and proxy credentials from manifests;
  secrets are now SealedSecrets in the gitops repo

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/platform/values-abrban.yaml

@@ -1,56 +0,0 @@
-# Production values for abrban.com — used by ArgoCD / Gitea Actions GitOps
-namespace: cloudhost
-createNamespace: false
-
-global:
-  storageClass: local-path
-
-images:
-  backend:
-    repository: registry.abrban.com/abrban/cloudhost-backend
-    tag: "1.0.0"
-    pullPolicy: Always
-  frontend:
-    repository: registry.abrban.com/abrban/cloudhost-frontend
-    tag: "1.0.0"
-    pullPolicy: Always
-
-backend:
-  imagePullSecrets:
-    - name: registry-pull-secret
-  sourceStorage:
-    enabled: true
-    existingSecret: ceph-app-sources-credentials
-  env:
-    NODE_ENV: production
-    PORT: "4000"
-    PLATFORM_DOMAIN: apps.abrban.com
-    REGISTRY_URL: registry.abrban.com
-    REGISTRY_PULL_URL: registry.abrban.com
-    BUILD_NAMESPACE: cloudhost-builds
-    BUILD_SERVICE_ACCOUNT: kaniko-builder
-    UPLOAD_DIR: /app/uploads
-    PLATFORM_CREATE_STORAGE_CLASS: "false"
-    PLATFORM_STORAGE_CLASS: rook-ceph-block
-    PLATFORM_STORAGE_PROVISIONER: rook-ceph.rbd.csi.ceph.com
-    ELASTICSEARCH_HOST: elasticsearch.logging.svc.cluster.local
-    ELASTICSEARCH_AUTO_PORT_FORWARD: "false"
-
-frontend:
-  imagePullSecrets:
-    - name: registry-pull-secret
-
-ingress:
-  enabled: true
-  className: traefik
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-  frontend:
-    host: abrban.com
-  panel:
-    host: panel.abrban.com
-  api:
-    host: api.abrban.com
-  tls:
-    enabled: true
-    secretName: abrban-wildcard-tls