CronJobs were referencing 'myorg-assistant:latest' (a local image that
doesn't exist in the cluster), causing ImagePullBackOff on all 4 active
CronJob pods. Updated all 5 CronJob manifests to use the same image as
the Deployment (git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf)
and added imagePullSecrets: gitea-registry for authentication.
The platform-engineer ArgoCD account was created (argocd-cm.yaml) with
apiKey capability, but no argocd-rbac-cm ConfigMap existed, so the account
had default (empty) RBAC and every API call returned 403.
This adds the RBAC policy granting the platform-engineer role:
- get applications (all projects/namespaces)
- sync applications (all projects/namespaces)
- get projects
Needed for the platform-engineer cron jobs to read app health and trigger
syncs via the ArgoCD API.
