Split Endpoints into separate file for kustomize discovery

Kustomize didn't pick up the Endpoints from the multi-document YAML
in svc-forge-external.yaml. Split into a separate endpoints-forge.yaml
and add to kustomization.yaml resources.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

argocd/manifests/tailscale-operator/endpoints-forge.yaml

@@ -0,0 +1,15 @@
+---
+# Manual Endpoints pointing to indri's Tailscale IP for the
+# forge-external Service. Must match the Service name exactly.
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: forge-external
+  namespace: tailscale
+subsets:
+  - addresses:
+      - ip: 100.98.163.89
+    ports:
+      - name: http
+        port: 3001
+        protocol: TCP

argocd/manifests/tailscale-operator/kustomization.yaml

@@ -9,4 +9,5 @@ resources:
   - proxygroup-ingress.yaml
   - external-secret.yaml
   - svc-forge-external.yaml
+  - endpoints-forge.yaml
   - ingress-forge.yaml

argocd/manifests/tailscale-operator/svc-forge-external.yaml

@@ -1,8 +1,8 @@
 ---
-# Headless service + manual Endpoints to route to Forgejo on indri.
+# ClusterIP service for Forgejo on indri. Paired with endpoints-forge.yaml
+# which provides the actual routing to indri's Tailscale IP.
 # ExternalName services don't have a ClusterIP, which the Tailscale
-# ingress operator requires. This pattern creates a real ClusterIP
-# that forwards to indri's Tailscale IP.
+# ingress operator requires.
 apiVersion: v1
 kind: Service
 metadata:
@@ -13,16 +13,3 @@ spec:
     - name: http
       port: 3001
       protocol: TCP
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: forge-external
-  namespace: tailscale
-subsets:
-  - addresses:
-      - ip: 100.98.163.89
-    ports:
-      - name: http
-        port: 3001
-        protocol: TCP