Remove nessus app and fix envoy-gateway OCI chart bug

- Delete nessus Application CRD, manifests, and bootstrap script
- Vendor envoy-gateway Helm chart (v1.6.3) locally to work around
  ArgoCD v3.3.3 Docker Hub OCI resolution bug
- Re-enable auto-sync for envoy-gateway

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/nessus-bootstrap.sh

@@ -1,121 +0,0 @@
-#!/bin/bash
-# Nessus Bootstrap Script - Fully Automated
-# This script runs as a presync hook to set up Nessus dependencies
-
-set -euo pipefail
-
-echo "=================================================================="
-echo "Nessus Presync - Fully Automated Bootstrap"
-echo "=================================================================="
-echo "This will set up:"
-echo "  ✓ PostgreSQL database (CloudNativePG) with low resources"
-echo "  ✓ Auto-generated database password (via ESO)"
-echo "  ✓ Admin credentials from Vault"
-echo "  ✓ Persistent storage for scan data"
-echo "  ✓ OAuth2-Proxy authentication (Authentik SSO)"
-echo ""
-echo "Expected time: 3-5 minutes"
-echo "=================================================================="
-echo ""
-
-NS=nessus
-CLUSTER=pg-nessus
-
-# Get the script directory and move to repo root
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-cd "${REPO_ROOT}/apps" || exit 1
-
-# 1) Ensure namespace exists
-echo "⚙️  Creating namespace ${NS}..."
-kubectl get ns "${NS}" >/dev/null 2>&1 || kubectl create ns "${NS}"
-
-# 2) Apply CNPG cluster (auto-generates DB password)
-echo "⚙️  Deploying PostgreSQL cluster (low resources)..."
-kubectl apply -f nessus/cnpg-cluster.yaml
-
-# 3) Wait for CNPG cluster to be ready
-echo "⏳ Waiting for PostgreSQL cluster to be ready..."
-kubectl -n "${NS}" wait --for=condition=Ready "cluster/${CLUSTER}" --timeout=300s || {
-  echo "⚠️  WARNING: PostgreSQL cluster not ready yet"
-  echo "   This is normal on first deployment - rerun 'helmfile apply' in a few minutes"
-  exit 0
-}
-echo "✅ PostgreSQL cluster ready"
-echo ""
-
-# 4) Apply ESO secrets (auto-rotate DB passwords)
-echo "⚙️  Configuring auto-rotating database passwords..."
-kubectl apply -f nessus/cnpg-secrets.yaml
-
-# Wait for DB secret to sync
-echo "⏳ Waiting for database secret to sync..."
-for i in {1..30}; do
-  if kubectl -n "${NS}" get secret nessus-db-secret >/dev/null 2>&1; then
-    echo "✅ Database secret synced"
-    break
-  fi
-  echo "   waiting... (attempt $i/30)"
-  sleep 2
-done
-
-# 5) Apply Nessus admin credentials ExternalSecret
-echo "⚙️  Syncing admin credentials from Vault..."
-kubectl apply -f nessus/external-secret.yaml
-
-# Wait for admin secret to sync
-echo "⏳ Waiting for admin credentials to sync from Vault..."
-for i in {1..30}; do
-  if kubectl -n "${NS}" get secret nessus-admin-credentials >/dev/null 2>&1; then
-    echo "✅ Admin credentials synced from Vault"
-    break
-  fi
-  echo "   waiting... (attempt $i/30)"
-  sleep 2
-done
-
-# Check if credentials exist in Vault
-if ! kubectl -n "${NS}" get secret nessus-admin-credentials >/dev/null 2>&1; then
-  echo ""
-  echo "⚠️  WARNING: Nessus admin credentials not found in Vault!"
-  echo ""
-  echo "BOOTSTRAP REQUIRED - Run this command first:"
-  echo "=================================================================="
-  echo "kubectl exec -n vault vault-0 -- vault kv put secret/nessus \\"
-  echo "  admin-username=\"admin\" \\"
-  echo "  admin-password=\"YourSecurePassword123!\""
-  echo "=================================================================="
-  echo ""
-  echo "After storing credentials, rerun: helmfile apply"
-  echo ""
-  exit 1
-fi
-
-# 6) Apply PVC for Nessus scan data
-echo "⚙️  Creating persistent storage for scan data..."
-kubectl apply -f nessus/pvc.yaml
-
-# 7) Apply Nessus deployment
-echo "⚙️  Deploying Nessus scanner..."
-kubectl apply -f nessus/deployment.yaml
-
-# 8) Apply Nessus ingress
-echo "⚙️  Configuring ingress with OAuth2-Proxy..."
-kubectl apply -f nessus/ingress.yaml
-
-echo ""
-echo "✅ Nessus presync complete - fully automated!"
-echo ""
-echo "=================================================================="
-echo "IMPORTANT: First-time setup instructions"
-echo "=================================================================="
-echo ""
-echo "If you haven't already, store Nessus credentials in Vault:"
-echo ""
-echo "kubectl exec -n vault vault-0 -- vault kv put secret/nessus \\"
-echo "  admin-username=\"admin\" \\"
-echo "  admin-password=\"YourSecurePassword123!\""
-echo ""
-echo "Then rerun: helmfile apply"
-echo "=================================================================="
-echo ""