fix: corrected ApplicationSet template, drop secret stubs from manifests

- appset: goTemplate, filename-based app names, .path.path IS the directory,
  exclude apps/root from the glob (v3.5 git files-generator schema)
- remove empty Secret stubs: with prune:true they would overwrite live
  secret values (openwebui, paperless, vaultwarden-admin-token, password)
- secrets stay cluster-managed, not in git

bootstrap/argocd-install/kustomization.yaml

@@ -4,7 +4,9 @@ kind: Kustomization
 namespace: argocd
 
 resources:
-  - https://github.com/argoproj/argo-cd.git/manifests/crds?ref=stable
+  # cluster-install already includes ALL CRDs (applications, appprojects,
+  # applicationsets). Do NOT also add manifests/crds — kustomize fails with
+  # "may not add resource with an already registered id".
   - https://github.com/argoproj/argo-cd.git/manifests/cluster-install?ref=stable
   - ingress.yaml