feat: migrate vso-system to ArgoCD

Migrate Vault Secrets Operator from Terragrunt to ArgoCD/Kustomize.
Deploys vault-secrets-operator v1.2.0 with 3 replicas, plus ClusterRole,
ClusterRoleBindings, and vault-admin ServiceAccount.

Note: static service account tokens (kubernetes.io/service-account-token)
cannot be stored in git; create manually or via Vault after deployment.

💘 Generated with Crush

Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>

apps/overlays/au-syd1/vso-system/kustomization.yaml

@@ -14,3 +14,11 @@ helmCharts:
     releaseName: vault-secrets-operator
     namespace: vso-system
     valuesFile: values.yaml
+
+patches:
+  - path: patch_vaultauth-remove-namespace.yaml
+    target:
+      group: secrets.hashicorp.com
+      version: v1beta1
+      kind: VaultAuth
+      name: default

apps/overlays/au-syd1/vso-system/patch_vaultauth-remove-namespace.yaml

@@ -0,0 +1,2 @@
+- op: remove
+  path: /spec/namespace

apps/overlays/au-syd1/vso-system/values.yaml

@@ -8,6 +8,7 @@ defaultAuthMethod:
   enabled: true
   method: "kubernetes"
   mount: "k8s/au/syd1"
+  namespace: ""
   kubernetes:
     role: "default"
     serviceAccount: "vault-secrets-operator-controller-manager"