feat: migrate vso-system to ArgoCD

Migrate Vault Secrets Operator from Terragrunt to ArgoCD/Kustomize.
Deploys vault-secrets-operator v1.2.0 with 3 replicas, plus ClusterRole,
ClusterRoleBindings, and vault-admin ServiceAccount.

Note: static service account tokens (kubernetes.io/service-account-token)
cannot be stored in git; create manually or via Vault after deployment.

💘 Generated with Crush

Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>

argocd/projects/platform.yaml

@@ -10,6 +10,7 @@ spec:
     - https://git.unkin.net/unkin/argocd-apps
     - https://charts.jetstack.io
     - https://cloudnative-pg.github.io/charts
+    - https://helm.releases.hashicorp.com
     - https://intel.github.io/helm-charts/
     - https://kubernetes-sigs.github.io/external-dns/
     - https://releases.rancher.com/server-charts/stable