fix: add sync-wave -1 to Jenkins ExternalSecrets

Secrets must exist before Jenkins pod mounts them.
Sync wave -1 ensures ESO creates secrets before Jenkins Helm resources.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

manifest/jenkins/external-secrets/gitea-credentials.yaml

@@ -3,6 +3,8 @@ kind: ExternalSecret
 metadata:
   name: gitea-credentials
   namespace: jenkins
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
 spec:
   refreshInterval: 1h
   secretStoreRef: