docs: never store argocd admin password hash in git

Drop .env/envsubst/bake-hash-into-values.yaml flow entirely. Chart's
configs.secret block is removed for good, so the rendered manifest
never declares admin.password/admin.passwordMtime. Password hash is
set once directly on the live argocd-secret via kubectl patch, and
survives every self-heal sync since ArgoCD never owns those fields.

manifests/argocd/values.yaml

@@ -18,9 +18,6 @@ global:
 configs:
   params:
     server.insecure: true   # TLS terminated at Envoy Gateway
-  secret:
-    argocdServerAdminPassword: "$ARGOCD_ADMIN_PASSWORD_HASH"
-    argocdServerAdminPasswordMtime: "2025-01-01T00:00:00Z"
 
 server:
   replicas: 1