correction: credential-forward + unified graph; activate SOPS (author-first)

Operator directive: don't diverge architecture to avoid asking for credentials;
provision them upfront via SOPS and keep the existing (unified) graph.

Roadmap reconciliation: Phase 2 = Network/Storage/TLS/DNS/Ingress, so
cert-manager/externaldns/gateway (the credential-gated pieces) ARE Phase 2;
monitoring is Phase 4. Earlier A2/rollout scope was inverted by credential-avoidance.

Reverts (credential-driven): remove clusters/dev/rollout/ + the $patch:delete's;
restore unified base graph (dev = ../base + cluster-vars + SOPS decryption,
R-ENV-02 intact); restore monitoring files (Phase 4). Kept non-credential
improvements: tofu for_each/rejoin, Kyverno parametrization + webhook excludes.

platform/kustomization.yaml now phased (single shared list): Phase-2 set =
kyverno, cilium, longhorn, cert-manager, externaldns, gateway; later components
commented with phase markers.

SOPS activated: .sops.yaml at repo root; bootstrap/sops/secret-templates/*.yaml.example
for all secrets (cloudflare x2, grafana, alertmanager-smtp, keycloak, oauth2-proxy, pia);
bootstrap/sops/CREDENTIALS.md checklist; pre-wired commented cloudflare-api-token lines
in cert-manager + externaldns; filled non-secret ACME email. Agents never touch real
secret values (operator encrypts).

Validated: kubectl kustomize dev(unified)/prod/platform(Phase-2 only), templates inert,
make -C ci gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

bootstrap/sops/secret-templates/cloudflare-api-token.cert-manager.yaml.example

@@ -0,0 +1,23 @@
+# =============================================================================
+# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
+# and never auto-encrypted by SOPS). Reference scaffold only.
+#
+# (a) Copy to:      platform/cert-manager/cloudflare-api-token.sops.yaml
+# (b) kustomization: add this line under `resources:` in
+#                    platform/cert-manager/kustomization.yaml
+#                       - cloudflare-api-token.sops.yaml
+# (c) Encrypt:       sops -e -i platform/cert-manager/cloudflare-api-token.sops.yaml
+# (d) Consumed by:   cert-manager ClusterIssuers (DNS-01 solver). The Cloudflare
+#                    DNS-01 solver's apiTokenSecretRef points at secret
+#                    `cloudflare-api-token`, key `api-token`. [Phase 2]
+#
+# The token must be a Cloudflare API token with Zone:DNS:Edit + Zone:Read scope.
+# =============================================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-api-token
+  namespace: cert-manager
+type: Opaque
+stringData:
+  api-token: REPLACE-ME-CLOUDFLARE-DNS-EDIT-TOKEN