feat: Update FluxCD manifests with validated infrastructure configs

Lessons from manual validation run:
- Add privileged PodSecurity labels to metallb-system, rook-ceph, ingress namespaces
- Add Cilium HelmRelease with Talos-specific settings (cgroup, kubePrism)
- Consolidate all namespace definitions in namespaces/
- Update cert-manager to use crds.enabled instead of installCRDs
- Enable all infrastructure components in main kustomization
- Add Talos secrets to .gitignore (controlplane.yaml, talosconfig)
- Update node patches with correct install disk (vda) and zone labels

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitignore

@@ -4,4 +4,9 @@ shell.nix
 .direnv/
 *.log
 /immich
-*.tfplan
+*.tfplan
+
+# Talos secrets (generated, never commit)
+kubernetes/talos/controlplane.yaml
+kubernetes/talos/worker.yaml
+kubernetes/talos/talosconfig