Migrate Homepage Ingress to shared ProxyGroup

Disable Helm-managed Ingress (chart doesn't support tailscale.com/*
annotations) and create a separate ingress-tailscale.yaml with
proxy-group annotation, matching the pattern used by all other services.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

argocd/manifests/homepage/ingress-tailscale.yaml

@@ -0,0 +1,27 @@
+# Tailscale Ingress for Homepage
+# Exposes at go.tail8d86e.ts.net
+# Caddy proxies go.ops.eblu.me to this
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: homepage-tailscale
+  namespace: homepage
+  annotations:
+    tailscale.com/funnel: "false"
+    tailscale.com/proxy-group: "ingress"
+    gethomepage.dev/enabled: "false"
+spec:
+  ingressClassName: tailscale
+  rules:
+    - http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: homepage
+                port:
+                  number: 3000
+  tls:
+    - hosts:
+        - go

argocd/manifests/homepage/values.yaml

@@ -7,22 +7,11 @@ enableRbac: true
 serviceAccount:
   create: true
 
-# Tailscale Ingress - exposes at go.tail8d86e.ts.net
-# Caddy proxies go.ops.eblu.me to this
+# Tailscale Ingress is managed separately in ingress-tailscale.yaml
+# (Helm chart template doesn't support tailscale.com/* annotations)
 ingress:
   main:
-    enabled: true
-    ingressClassName: tailscale
-    annotations:
-      gethomepage.dev/enabled: "false"
-    hosts:
-      - host: go
-        paths:
-          - path: /
-            pathType: Prefix
-    tls:
-      - hosts:
-          - go
+    enabled: false
 
 env:
   - name: HOMEPAGE_ALLOWED_HOSTS