Migrate 1Password Connect from Helm to kustomize (1.8.1 → 1.8.2) (#326)

## Summary

- Renders manifests from `connect-helm-charts v2.4.1` as plain kustomize (deployment + service)
- Bumps 1Password Connect from 1.8.1 → 1.8.2
- Completes the no-helm-policy migration — all services now use kustomize
- Retains all production hardening from the Helm chart (securityContext, runAsNonRoot, drop ALL, seccomp, resource limits)

## Changes

- **New:** `deployment.yaml`, `service.yaml`, `kustomization.yaml` in `argocd/manifests/1password-connect/`
- **Rewritten:** Both ArgoCD app definitions (indri + ringtail) — single source kustomize instead of multi-source Helm
- **Deleted:** `values.yaml` (Helm values no longer needed)
- **Updated:** `no-helm-policy.md`, `service-versions.yaml`, `README.md`

## Deployment plan

1. Sync `apps` app to pick up the new app definitions
2. `argocd app set 1password-connect --revision 1password-connect-kustomize`
3. `argocd app sync 1password-connect` — verify on indri
4. Repeat for ringtail
5. After merge: reset revision to main, re-sync both

## Test plan

- [ ] `kubectl kustomize` renders cleanly (verified locally)
- [ ] ArgoCD diff shows expected changes (Helm labels removed, images bumped)
- [ ] Pods come up healthy on indri
- [ ] External Secrets still resolves 1Password items
- [ ] Repeat on ringtail

Reviewed-on: #326

service-versions.yaml

@@ -134,10 +134,10 @@ services:
 
   - name: 1password-connect
     type: argocd
-    last-reviewed: 2026-02-26
-    current-version: "1.8.1"
+    last-reviewed: 2026-04-06
+    current-version: "1.8.2"
     upstream-source: https://hub.docker.com/r/1password/connect-api/tags
-    notes: Deployed via Helm chart (chart v2.3.0)
+    notes: Kustomize manifests rendered from connect-helm-charts v2.4.1
 
   - name: argocd
     type: argocd