refactor: bootstrap/infra/ci separation (#27)

- Create bootstrap/ dir: cert-manager, traefik-routes, argo-rollouts,
  kargo, kargo-*-pipeline (not managed by Kargo promotion)
- infra/ now only: gitea, gitea-custom (promoted by Kargo)
- ci/ unchanged: gitea-runner (promoted by Kargo)
- Split kargo/credentials/ into dev/ and prod/ with separate ksops generators
- Remove kargo-credentials from AppSet (managed by Pulumi Go code)
- Update infra Warehouse: only gitea (was also argo-rollouts, cert-manager)
- Update infra Stage dev: only yaml-update for gitea version
- Fix test-env warehouse: valid subscription instead of empty array
- Update step numbers: bootstrap 1-5, infra 1-2

bootstrap/traefik-routes/manifests/middlewares.yaml

@@ -0,0 +1,57 @@
+# HTTP → HTTPS redirect
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: kube-system
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+# Forward X-Forwarded-Proto header for backends behind TLS termination
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: sslheader
+  namespace: kube-system
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+---
+# Gitea: buffer large requests (git push) + timeout for CI builds
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: gitea-buffer-timeout
+  namespace: gitea
+spec:
+  buffering:
+    maxRequestBodyBytes: 0
+    maxResponseBodyBytes: 0
+    memRequestBodyBytes: 20971520
+    memResponseBodyBytes: 20971520
+    retryExpression: "IsNetworkError()"
+---
+# ArgoCD: X-Forwarded-Proto for TLS termination
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: argocd-tls-middleware
+  namespace: argocd
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+---
+# Kargo: X-Forwarded-Proto for TLS termination
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: kargo-tls-middleware
+  namespace: kargo
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"