Upgrade ArgoCD v3.2.6 → v3.3.2 with Server-Side Apply (#272)

## Summary
- Upgrade ArgoCD from v3.2.6 to v3.3.2
- Enable `ServerSideApply=true` sync option (required by v3.3 — ApplicationSet CRD exceeds client-side apply annotation limit)
- Update service-versions.yaml with review for argocd and 1password-connect

## Breaking changes reviewed
- **Server-Side Apply required**: Added to syncOptions ✅
- **Source Hydrator git notes**: Not used — N/A
- **Application path cleaning removed**: Not used — N/A
- **Settings API field restriction**: Authenticated access only — N/A

## Deployment and Testing
- [ ] Sync the `apps` app first (picks up SSA syncOption change)
- [ ] `argocd app set argocd --revision feature/argocd-v3.3.2`
- [ ] `argocd app sync argocd`
- [ ] Verify all argocd pods running with v3.3.2 images
- [ ] Verify other apps still sync correctly
- [ ] After merge: `argocd app set argocd --revision main && argocd app sync argocd`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/272

argocd/apps/argocd.yaml

@@ -17,3 +17,4 @@ spec:
   syncPolicy:
     syncOptions:
       - CreateNamespace=true
+      - ServerSideApply=true

argocd/manifests/argocd/kustomization.yaml

@@ -5,7 +5,7 @@ namespace: argocd
 
 resources:
   # Pin to specific version for intentional upgrades
-  - https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.6/manifests/install.yaml
+  - https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.2/manifests/install.yaml
   - ingress-tailscale.yaml
   - external-secret-repo-forge.yaml
 

docs/changelog.d/feature-argocd-v3.3.2.infra.md

@@ -0,0 +1 @@
+Upgrade ArgoCD from v3.2.6 to v3.3.2 with Server-Side Apply enabled

service-versions.yaml

@@ -110,16 +110,17 @@ services:
 
   - name: 1password-connect
     type: argocd
-    last-reviewed: null
-    current-version: null
-    upstream-source: https://github.com/1Password/connect/releases
-    notes: Deployed via Helm chart
+    last-reviewed: 2026-02-26
+    current-version: "1.8.1"
+    upstream-source: https://hub.docker.com/r/1password/connect-api/tags
+    notes: Deployed via Helm chart (chart v2.3.0)
 
   - name: argocd
     type: argocd
-    last-reviewed: null
-    current-version: null
+    last-reviewed: 2026-02-26
+    current-version: "v3.3.2"
     upstream-source: https://github.com/argoproj/argo-cd/releases
+    notes: Kustomize-based install with ServerSideApply
 
   - name: blumeops-pg
     type: argocd