Migrate 1Password Connect from Helm to kustomize (1.8.1 → 1.8.2) (#326)

## Summary

- Renders manifests from `connect-helm-charts v2.4.1` as plain kustomize (deployment + service)
- Bumps 1Password Connect from 1.8.1 → 1.8.2
- Completes the no-helm-policy migration — all services now use kustomize
- Retains all production hardening from the Helm chart (securityContext, runAsNonRoot, drop ALL, seccomp, resource limits)

## Changes

- **New:** `deployment.yaml`, `service.yaml`, `kustomization.yaml` in `argocd/manifests/1password-connect/`
- **Rewritten:** Both ArgoCD app definitions (indri + ringtail) — single source kustomize instead of multi-source Helm
- **Deleted:** `values.yaml` (Helm values no longer needed)
- **Updated:** `no-helm-policy.md`, `service-versions.yaml`, `README.md`

## Deployment plan

1. Sync `apps` app to pick up the new app definitions
2. `argocd app set 1password-connect --revision 1password-connect-kustomize`
3. `argocd app sync 1password-connect` — verify on indri
4. Repeat for ringtail
5. After merge: reset revision to main, re-sync both

## Test plan

- [ ] `kubectl kustomize` renders cleanly (verified locally)
- [ ] ArgoCD diff shows expected changes (Helm labels removed, images bumped)
- [ ] Pods come up healthy on indri
- [ ] External Secrets still resolves 1Password items
- [ ] Repeat on ringtail

Reviewed-on: #326

argocd/apps/1password-connect-ringtail.yaml

@@ -1,5 +1,5 @@
 # 1Password Connect for ringtail k3s cluster
-# Same chart/values as indri, different destination
+# Same manifests as indri, different destination
 #
 # Prerequisites:
 # 1. Bootstrap secrets via ansible (provision-ringtail creates 1password namespace,
@@ -13,17 +13,10 @@ metadata:
   namespace: argocd
 spec:
   project: default
-  sources:
-    - repoURL: ssh://forgejo@forge.ops.eblu.me:2222/mirrors/connect-helm-charts.git
-      targetRevision: connect-2.3.0
-      path: charts/connect
-      helm:
-        releaseName: onepassword-connect
-        valueFiles:
-          - $values/argocd/manifests/1password-connect/values.yaml
-    - repoURL: ssh://forgejo@forge.ops.eblu.me:2222/eblume/blumeops.git
-      targetRevision: main
-      ref: values
+  source:
+    repoURL: ssh://forgejo@forge.ops.eblu.me:2222/eblume/blumeops.git
+    targetRevision: main
+    path: argocd/manifests/1password-connect
   destination:
     server: https://ringtail.tail8d86e.ts.net:6443
     namespace: 1password