feat(infra): deploy ArgoCD via Helm (argocd.tf)

argo-helm chart, notifications controller enabled (required for
ArgoCD → GitHub webhook integration in Act-3). Admin password
auto-generated, sensitive output. LoadBalancer service type.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: raykao

infra/argocd.tf

@@ -1 +1,33 @@
-# ArgoCD via Helm - see task dark-factory-y4c
+resource "random_password" "argocd_admin" {
+  length  = 16
+  special = true
+}
+
+resource "helm_release" "argocd" {
+  name             = "argocd"
+  repository       = "https://argoproj.github.io/argo-helm"
+  chart            = "argo-cd"
+  version          = var.argocd_chart_version
+  namespace        = kubernetes_namespace.argocd.metadata[0].name
+  create_namespace = false
+  wait             = true
+  timeout          = 600
+
+  set {
+    name  = "configs.secret.argocdServerAdminPassword"
+    value = bcrypt(random_password.argocd_admin.result)
+  }
+
+  set {
+    name  = "server.service.type"
+    value = "LoadBalancer"
+  }
+
+  # Enable notifications controller for ArgoCD notifications
+  set {
+    name  = "notifications.enabled"
+    value = "true"
+  }
+
+  depends_on = [kubernetes_namespace.argocd]
+}

infra/outputs.tf

@@ -63,3 +63,9 @@ output "kube_config" {
   value       = azurerm_kubernetes_cluster.main.kube_config_raw
   sensitive   = true
 }
+
+output "argocd_admin_password" {
+  description = "ArgoCD admin password — use with username 'admin'"
+  value       = random_password.argocd_admin.result
+  sensitive   = true
+}