Establish a PEEKS/OAP visual brand (ArgoCD UI via argocd-cm as first enabler)

## Summary

Establish a consistent **visual brand / identity for PEEKS and OAP** across the workshop surfaces, so the environment feels like a cohesive AWS-branded platform rather than a set of default upstream tools. Customizing the managed ArgoCD UI via `argocd-cm` (Configuration V2) is **one of the enablers** for this.

## Goal

A recognizable, consistent look-and-feel (colors, banner, logo, naming) applied wherever the user lands in the platform — starting with the GitOps control plane (ArgoCD), and extensible to other UIs (Backstage, dashboards, docs).

## First enabler — ArgoCD UI via `argocd-cm`

The EKS managed ArgoCD capability supports a subset of `argocd-cm` settings (Configuration V2, GA). Add an example `argocd-cm` (namespace `argocd`, label `app.kubernetes.io/part-of: argocd`) that brands the ArgoCD UI:

- **Banner** identifying the platform and linking to the workshop repo (`ui.bannercontent`, `ui.bannerurl`, `ui.bannerpermanent`, `ui.bannerposition`).
- **Custom CSS** (`ui.cssurl`) — AWS-styled banner + an added platform icon next to the native logo (kept, not replaced). The custom logo key (`ui.logourl`) is **not** supported by the capability, so branding the logo is done via CSS (`::after` on the logo container, `pointer-events: none` so the collapse arrow stays clickable).
- Constraint: the CSS must be served as `text/css`. A raw GitHub file is served as `text/plain` + `nosniff` and is **blocked** by browsers as a stylesheet — serve it through a CDN that rewrites the content-type, SHA-pinned.
- Keep native health colors intact (ArgoCD sets them inline) — the CSS must not mask Degraded/red.

## Related enablers (same brand effort)

- **Performance / hygiene** via `resource.exclusions` (exclude high-churn types like `metrics.k8s.io`) and a **global** `resource.customizations.ignoreDifferences` for the cross-cutting `ExternalSecret` status/metadata block (today repeated per-addon across the registries). It merges (Appends) with per-app `spec.ignoreDifferences`, so it can be adopted incrementally.

## Notes / constraints

- Two-plane model: the capability API controls identity/namespace/network/RBAC only; **behaviour and UI settings live in the `argocd-cm` ConfigMap** in-cluster.
- Unsupported keys (`configManagementPlugins`, `exec.enabled`, `ui.logourl`, …) are **silently ignored** by the capability — no error surfaced.
- Reference: [EKS docs — Configure Argo CD settings](https://docs.aws.amazon.com/eks/latest/userguide/argocd-configure-settings.html)

## Next

A PR will add the branded `argocd-cm` manifest + CSS/icon assets (committed in-repo, served as `text/css`, SHA-pinned) and de-duplicate the redundant per-addon `ignoreDifferences`. Broader brand work (other UIs, naming) tracked separately.

Start with the EKS Configure Argo CD settings reference and the Configuration V2 argocd-cm requirements. Add the branded argocd-cm manifest plus committed CSS and icon assets, ensuring the stylesheet is served as text/css and SHA-pinned; done also includes the specified resource exclusions and global ExternalSecret ignoreDifferences without masking native health colors.

Written by the indexing model from the issue text.