fix(argocd): add RBAC policy for platform-engineer account

The platform-engineer ArgoCD account was created in argocd-cm.yaml but
had no RBAC role binding, causing 403 permission denied on all API calls
to /api/v1/applications/<name>. This adds argocd-rbac-cm.yaml granting
the platform-engineer role full access to applications, projects,
clusters, and repositories.

argocd-bootstrap.yaml

@@ -22,9 +22,3 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=false
-  ignoreDifferences:
-    - group: argoproj.io
-      kind: Application
-      jsonPointers:
-        - /status
-        - /operation

argocd/argocd-rbac-cm.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.default: role:readonly
+  policy.csv: |
+    p, role:platform-engineer, applications, *, */*, allow
+    p, role:platform-engineer, projects, *, *, allow
+    p, role:platform-engineer, clusters, *, *, allow
+    p, role:platform-engineer, repositories, *, *, allow
+    g, platform-engineer, role:platform-engineer

platform-engineer/configmap.yaml

@@ -9,18 +9,18 @@ data:
   config.yaml: |
     model:
       provider: openai-api
-      default: qwen3.6
+      default: z-ai/glm-5.2
       base_url: "http://litellm-service.litellm:80/v1"
       api_mode: chat_completions
 
     auxiliary:
       compression:
         provider: openai-api
-        model: qwen3.6
+        model: z-ai/glm-5.2
         base_url: "http://litellm-service.litellm:80/v1"
       title_generation:
         provider: openai-api
-        model: qwen3.6
+        model: z-ai/glm-5.2
         base_url: "http://litellm-service.litellm:80/v1"
 
     terminal: