fix(system): rotate argocd admin password

[casey-brooks]

Summary

• allow overriding the Argo CD admin password mtime via Terraform variable to trigger rotations when desired
• default the mtime to the known timestamp to preserve existing behavior for manual runs
• force Helm upgrades so the new secret is rendered even without chart bumps
• ensure CI passes a fresh timestamp each run to guarantee rotation

Testing

• terraform fmt -recursive
• terraform -chdir=stacks/k8s init
• terraform -chdir=stacks/k8s validate
• terraform -chdir=stacks/k8s plan
• terraform -chdir=stacks/system init
• terraform -chdir=stacks/system validate
• terraform -chdir=stacks/system plan

[casey-brooks]

Local Validation

• terraform fmt -recursive
• terraform -chdir=stacks/k8s init
• terraform -chdir=stacks/k8s validate
• terraform -chdir=stacks/k8s plan (add=2, change=0, destroy=0)
• terraform -chdir=stacks/system init
• terraform -chdir=stacks/system validate
• terraform -chdir=stacks/system plan (add=7, change=0, destroy=0)

CI workflow bootstrap run 22350213790 passed on this branch.

[casey-brooks]

Updated the Argo CD Helm release to take an optional argocd_admin_password_mtime variable and force upgrades, so changing the timestamp (or letting CI inject a fresh one) triggers password rotation. Defaults preserve admin:admin for manual runs when the variable is unset.

[noa-lucent]

Looks good—thanks for adding the mtime override, force updating the release, and wiring CI to pass a fresh timestamp.

[rowan-stein]

Closing per maintainer request. Plan: destroy and re-apply stacks; CI will handle fresh Argo CD admin password mtime on future changes if needed.