chore: mount vault CA for helm TLS trust and add ArgoCD self-management

- Patch argocd-repo-server to mount vault-ca-cert and set SSL_CERT_DIR
  so helm subprocesses trust the internal CA when pulling charts
- Add argocd Application pointing at clusters/au-syd1/bootstrap so
  ArgoCD manages its own install going forward

clusters/au-syd1/bootstrap/kustomization.yaml

@@ -5,6 +5,7 @@ kind: Kustomization
 resources:
   - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v3.3.2/manifests/ha/install.yaml
   - au-syd1-apps.yaml
+  - argocd-self-app.yaml
 
 patches:
   - path: argocd-cm-patch.yaml
@@ -15,3 +16,7 @@ patches:
     target:
       kind: ConfigMap
       name: argocd-tls-certs-cm
+  - path: argocd-repo-server-vault-ca-patch.yaml
+    target:
+      kind: Deployment
+      name: argocd-repo-server