add: metrics-server for kubectl top / HPA

Metrics API (metrics.k8s.io) wasn't registered, so kubectl top failed with
'Metrics API not available'. kube-state-metrics from kube-prometheus-stack
doesn't provide it. Uses --kubelet-insecure-tls since kubeadm kubelets serve
self-signed certs (no serverTLSBootstrap), and scrapes kubelets by
InternalIP.

README.md

@@ -15,6 +15,7 @@ Bootstrap order (sync waves):
   Wave 1 → metallb-config   (IPAddressPool + L2Advertisement)
   Wave 2 → envoy-gateway    (HTTP gateway controller)
   Wave 2 → nfs-provisioner  (dynamic PVC provisioner from xpen NAS)
+  Wave 2 → metrics-server   (Metrics API for `kubectl top` / HPA, kube-system)
   Wave 3 → envoy-gateway-config (GatewayClass + EnvoyProxy + Gateway)
 
 External access:

bootstrap/apps/metrics-server.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metrics-server
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: default
+  sources:
+    - repoURL: https://kubernetes-sigs.github.io/metrics-server/
+      chart: metrics-server
+      targetRevision: "3.12.2"  # TODO: verify latest via `helm search repo metrics-server/metrics-server --versions`
+      helm:
+        valueFiles:
+          - $values/manifests/metrics-server/values.yaml
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  # Leaf app — manual sync only; root `bootstrap` app-of-apps stays automated.
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true

manifests/metrics-server/values.yaml

@@ -0,0 +1,12 @@
+# Serves the Metrics API (metrics.k8s.io) behind `kubectl top` and HPA.
+# Not the same as kube-state-metrics (kube-prometheus-stack) — that one only
+# exports object state to Prometheus, it doesn't register the Metrics API.
+args:
+  # Kubelets were bootstrapped by kubeadm without serverTLSBootstrap, so
+  # their serving certs are self-signed (not issued by the cluster CA) —
+  # metrics-server can't verify them. Drop this flag only after enabling
+  # serverTLSBootstrap on every kubelet + approving the serving CSRs.
+  - --kubelet-insecure-tls
+  # Nodes have no DNS-resolvable hostnames from inside the cluster; scrape
+  # kubelets by InternalIP (192.168.1.3x) instead.
+  - --kubelet-preferred-address-types=InternalIP