add argocd self-managed Application (sync-wave -1)

README.md

@@ -105,6 +105,23 @@ kubectl port-forward svc/argocd-server -n argocd 8080:443
 
 Open `https://localhost:8080` — login with `admin` and the password you chose.
 
+### 3.1 Bake the hash into values.yaml for self-management
+
+ArgoCD won't run `envsubst` when it self-manages — replace the placeholder with the real hash so future syncs work:
+
+```bash
+source .env
+sed -i "s|\$ARGOCD_ADMIN_PASSWORD_HASH|$ARGOCD_ADMIN_PASSWORD_HASH|" manifests/argocd/values.yaml
+```
+
+```bash
+git add manifests/argocd/values.yaml && git commit -m "set argocd admin password hash"
+```
+
+```bash
+git push origin main
+```
+
 ---
 
 ## Phase 4 — Create bootstrap app in ArgoCD UI