Fix degraded ArgoCD applications

- frigate: Remove duplicate PVCs (Helm manages them), update config size to 15Gi
- gitlab: Fix sync-admin-job secretKeyRef schema error, fetch password via kubectl
- nextcloud: Remove duplicate PVC, remove invalid pod-level securityContext
- rook-ceph: Update cephfs-smb-pvc to 50Gi, remove unsupported dashboard.config
- nessus: Add privileged PSS label for NET_ADMIN/NET_RAW capabilities
- scylla-manager: Add privileged PSS label for SYS_NICE capability
- n8n: Create missing n8n-main-persistence PVC
- projects: Add authentik namespace to applications project destinations

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/gitlab/manifests/sync-admin-job.yaml

@@ -26,7 +26,10 @@ spec:
 
           apk add --no-cache postgresql-client curl
 
-          echo "🔄 Syncing GitLab admin permissions from Authentik..."
+          echo "Syncing GitLab admin permissions from Authentik..."
+
+          # Fetch Authentik DB password from secret in authentik namespace
+          AUTHENTIK_DB_PASSWORD=$(kubectl get secret pg-authentik-app -n authentik -o jsonpath='{.data.password}' | base64 -d)
 
           # Get list of users in "authentik Admins" group
           ADMIN_USERS=$(PGPASSWORD="$AUTHENTIK_DB_PASSWORD" psql -h pg-authentik-rw.authentik.svc.cluster.local -U app -d app -t -c "
@@ -38,16 +41,16 @@ spec:
           " | xargs)
 
           if [ -z "$ADMIN_USERS" ]; then
-            echo "⚠️  No users found in 'authentik Admins' group"
+            echo "No users found in 'authentik Admins' group"
             exit 0
           fi
 
-          echo "✓ Found admin users: $ADMIN_USERS"
+          echo "Found admin users: $ADMIN_USERS"
           echo ""
 
           # For each admin user, grant admin access in GitLab
           for email in $ADMIN_USERS; do
-            echo "🔐 Checking user: $email"
+            echo "Checking user: $email"
 
             # Use GitLab Rails runner to promote user
             kubectl exec -n gitlab deployment/gitlab-toolbox -- \
@@ -55,26 +58,19 @@ spec:
                 user = User.find_by(email: '$email')
                 if user
                   if user.admin?
-                    puts '  ✓ Already admin'
+                    puts '  Already admin'
                   else
                     user.update(admin: true)
-                    puts '  ✅ Promoted to admin'
+                    puts '  Promoted to admin'
                   end
                 else
-                  puts '  ⚠️  User not found (needs to login via SSO first)'
+                  puts '  User not found (needs to login via SSO first)'
                 end
-              " || echo "  ❌ Failed to update user"
+              " || echo "  Failed to update user"
           done
 
           echo ""
-          echo "✅ Admin sync complete"
-        env:
-        - name: AUTHENTIK_DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: pg-authentik-app
-              namespace: authentik
-              key: password
+          echo "Admin sync complete"
       serviceAccountName: gitlab-sync-admin
 ---
 # ServiceAccount for the sync job
@@ -112,3 +108,30 @@ roleRef:
   kind: Role
   name: gitlab-sync-admin
   apiGroup: rbac.authorization.k8s.io
+---
+# Role to read Authentik DB secret
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: gitlab-sync-admin-reader
+  namespace: authentik
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+  resourceNames: ["pg-authentik-app"]
+---
+# RoleBinding for Authentik secret access
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gitlab-sync-admin-reader
+  namespace: authentik
+subjects:
+- kind: ServiceAccount
+  name: gitlab-sync-admin
+  namespace: gitlab
+roleRef:
+  kind: Role
+  name: gitlab-sync-admin-reader
+  apiGroup: rbac.authorization.k8s.io