Support private git repositories with GitHub App or token for ArgoCD

**Parent:** #584
**Priority:** High

ArgoCD needs authenticated access to private git repositories for:
- Fetching addon charts and registry files
- Reading fleet member values and overlays
- Syncing bootstrap ApplicationSets

**Implementation options:**

1. **GitHub App (recommended)** — install a GitHub App on the repo, store the App ID and private key in Secrets Manager, create an ArgoCD repo credential Secret via ExternalSecret
2. **Personal Access Token** — store PAT in Secrets Manager, create repo credential Secret
3. **SSH key** — store deploy key in Secrets Manager

**Changes needed:**
- Add `repo.auth` section to `config.yaml` schema (type: `github-app | token | ssh`)
- Seed GitHub App credentials or token in Secrets Manager during bootstrap
- Create ArgoCD repo credential Secret (`argocd.argoproj.io/secret-type: repository`) via ExternalSecret or bootstrap
- Update bootstrap ApplicationSets if repo URL format changes (HTTPS vs SSH)
- Document setup steps for each auth method

**ArgoCD repo credential format:**
```yaml
apiVersion: v1
kind: Secret
metadata:
name: repo-creds
namespace: argocd
labels:
argocd.argoproj.io/secret-type: repo-creds
stringData:
type: git
url: https://github.com/your-org
githubAppID: "12345"
githubAppInstallationID: "67890"
githubAppPrivateKey: |
-----BEGIN RSA PRIVATE KEY-----
...
```

Start with the config.yaml schema, bootstrap process, and bootstrap ApplicationSets mentioned in the issue. Trace how Secrets Manager values become ExternalSecrets and how ArgoCD repository credentials are represented. Done means the selected authentication method is configurable, credentials are seeded safely, repository access works during bootstrap, and setup steps for each method are documented.

Written by the indexing model from the issue text.