feat: add Argo CD Gateway and Zitadel OIDC

[patrickleet]

Summary

• expose Argo CD through the shared Gateway API listener
• configure native Argo CD OIDC from a Zitadel application managed in the target cluster
• pull the AuthStack PAT through External Secrets without placing credentials in the XR or Helm values
• map explicit OIDC email identities to Argo CD admin access
• derive readiness from the target ExternalSecret, Zitadel Project, and Zitadel OIDC application

Validation

• focused initial and observed-state up composition render cases pass
• source package built and installed in the bootstrap control plane as dev-c318163fd4c6
• live Zitadel Project and OIDC application are Ready in the production cluster
• live connection Secret is provider-owned, labeled for Argo CD, and contains the expected provider keys
• Argo CD Helm revision 3 is deployed; HTTPRoute is Accepted and ResolvedRefs=True
• https://argocd.p0.gitkb.com/ returns HTTP 200
• Argo public settings advertise Zitadel at https://auth.p0.gitkb.com with the generated client ID

Dependency

Stacked on #39 for existing-repository support used by Harmony.

KB: [[tasks/gitops-stack-zitadel-oidc]]

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 83596b8c-1853-4775-a811-65a948c5b8df

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}