correction: credential-forward + unified graph; activate SOPS (author-first)

Operator directive: don't diverge architecture to avoid asking for credentials;
provision them upfront via SOPS and keep the existing (unified) graph.

Roadmap reconciliation: Phase 2 = Network/Storage/TLS/DNS/Ingress, so
cert-manager/externaldns/gateway (the credential-gated pieces) ARE Phase 2;
monitoring is Phase 4. Earlier A2/rollout scope was inverted by credential-avoidance.

Reverts (credential-driven): remove clusters/dev/rollout/ + the $patch:delete's;
restore unified base graph (dev = ../base + cluster-vars + SOPS decryption,
R-ENV-02 intact); restore monitoring files (Phase 4). Kept non-credential
improvements: tofu for_each/rejoin, Kyverno parametrization + webhook excludes.

platform/kustomization.yaml now phased (single shared list): Phase-2 set =
kyverno, cilium, longhorn, cert-manager, externaldns, gateway; later components
commented with phase markers.

SOPS activated: .sops.yaml at repo root; bootstrap/sops/secret-templates/*.yaml.example
for all secrets (cloudflare x2, grafana, alertmanager-smtp, keycloak, oauth2-proxy, pia);
bootstrap/sops/CREDENTIALS.md checklist; pre-wired commented cloudflare-api-token lines
in cert-manager + externaldns; filled non-secret ACME email. Agents never touch real
secret values (operator encrypts).

Validated: kubectl kustomize dev(unified)/prod/platform(Phase-2 only), templates inert,
make -C ci gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

bootstrap/sops/secret-templates/README.md

@@ -0,0 +1,67 @@
+# SOPS Secret Templates
+
+This directory holds **reference templates** for the SOPS-encrypted secrets that
+platform components consume. They are **not applied and not encrypted**.
+
+## Why `.yaml.example`?
+
+Every file here uses a `.yaml.example` extension so that:
+
+- **kustomize never loads them** (they are not `.yaml` / not listed in any
+  `kustomization.yaml`), and
+- **SOPS never auto-encrypts them** (the repo's `.sops.yaml` creation rules match
+  `*.sops.yaml`, not `*.yaml.example`).
+
+They exist purely so the operator can see the exact Kubernetes Secret shape
+(name, namespace, keys) each component expects. **They contain only placeholder
+values** (`REPLACE-ME`, `<fill me>`) — never real secrets.
+
+## Operator flow (per secret)
+
+For each `<name>.yaml.example`:
+
+1. **Copy** it to the target path shown in the file's top comment, renaming to
+   `<name>.sops.yaml`. Example:
+
+   ```bash
+   cp bootstrap/sops/secret-templates/grafana-admin-credentials.yaml.example \
+      platform/monitoring/grafana-admin-credentials.sops.yaml
+   ```
+
+2. **Fill** in the real values (replace every `REPLACE-ME` / `<fill me>`).
+
+3. **Encrypt in place** with SOPS + age:
+
+   ```bash
+   sops -e -i platform/monitoring/grafana-admin-credentials.sops.yaml
+   ```
+
+4. **Wire it** into the component by adding the resource line (shown in the
+   file's top comment) under `resources:` in that component's
+   `kustomization.yaml`:
+
+   ```yaml
+   resources:
+     - grafana-admin-credentials.sops.yaml
+   ```
+
+5. **Commit** the encrypted `.sops.yaml` (ciphertext is safe to commit) and the
+   `kustomization.yaml` change. Flux decrypts it at reconcile via the cluster
+   age key.
+
+## Files in this directory
+
+| Template | Secret / namespace | Phase |
+|---|---|---|
+| `cloudflare-api-token.cert-manager.yaml.example` | `cloudflare-api-token` / `cert-manager` | 2 |
+| `cloudflare-api-token.external-dns.yaml.example` | `cloudflare-api-token` / `external-dns` (same token) | 2 |
+| `grafana-admin-credentials.yaml.example` | `grafana-admin-credentials` / `monitoring` | 4 |
+| `alertmanager-smtp.yaml.example` | `alertmanager-smtp` / `monitoring` | 4 |
+| `keycloak-admin-credentials.yaml.example` | `keycloak-admin-credentials` / `keycloak` | 6 |
+| `oauth2-proxy-credentials.yaml.example` | `oauth2-proxy-credentials` / `oauth2-proxy` | 6 |
+| `pia-credentials.yaml.example` | `pia-credentials` / TBD (Phase-3 VPN) | 3 |
+
+## Master checklist
+
+See [`bootstrap/sops/CREDENTIALS.md`](../CREDENTIALS.md) for the full,
+end-to-end credential provisioning flow and checklist.