AppProject RBAC policies use invalid wildcard `*` for resource type, breaking ArgoCD operations

# AppProject RBAC policies use invalid wildcard `*` for resource type, breaking ArgoCD operations

## APL Version

`linode/apl-tasks:v3.18.0`

## Describe the bug

APL generates `AppProject` resources for teams with RBAC policy rules that use `*` as the resource type:

```
p, proj:team-:platform-admin, *, *, team-/*, allow
p, proj:team-:team-member, *, get, team-/*, allow
```

The ArgoCD version shipped with APL v3.18.0 rejects `*` in the resource position and requires one of the explicit resource types: `applications`, `applicationsets`, `repositories`, `exec`, `logs`, or `clusters`.

This causes the following error when attempting to update project settings (e.g. changing a team's app-of-apps repository):

```
Unable to update project: invalid policy rule 'p, proj:team-:platform-admin, *, *, team-/*, allow':
project resource must be: 'applications', 'applicationsets', 'repositories', 'exec', 'logs' or 'clusters', not '*'
```

## Steps to reproduce

1. Install APL v3.18.0 on an LKE cluster
2. Create a team (e.g. `kmw-stage`)
3. Open the ArgoCD UI and navigate to the team's project settings
4. Attempt to modify the `sourceRepos` for the team's AppProject
5. Observe the error above

## Expected behavior

APL should generate valid AppProject policies using explicit resource types, e.g.:

```yaml
policies:
- "p, proj:team-:platform-admin, applications, *, team-/*, allow"
- "p, proj:team-:platform-admin, applicationsets, *, team-/*, allow"
- "p, proj:team-:platform-admin, repositories, *, team-/*, allow"
- "p, proj:team-:platform-admin, clusters, *, team-/*, allow"
- "p, proj:team-:platform-admin, logs, *, team-/*, allow"
- "p, proj:team-:platform-admin, exec, *, team-/*, allow"
```

The same expansion is needed for the `team-member` role (with action `get` instead of `*`).

## Actual AppProject generated by APL

```yaml
roles:
- name: platform-admin
description: Team member privileges to team-
groups:
- platform-admin
- team-
policies:
- p, proj:team-:platform-admin, *, *, team-/*, allow
- name: team-member
description: Team member privileges to team-
groups:
- team-
policies:
- p, proj:team-:team-member, *, get, team-/*, allow
```

## Additional context

- Manual patching of the `AppProject` via `kubectl patch` is immediately reverted by the APL reconciliation loop.
- The `read-only` and `ci-role` roles are unaffected because they already use `applications` as the explicit resource type.
- This appears to be a regression introduced when ArgoCD was upgraded to a version that enforces strict resource type validation in project-scoped policies.

Start by locating the AppProject generation templates that produce the platform-admin and team-member policies, then compare them with the unaffected read-only and ci-role policies. Expand the wildcard resource position to the six explicit resource types for both roles, and verify reconciliation produces policies accepted by ArgoCD when project settings are updated.

Written by the indexing model from the issue text.