infisical: bring self-hosted stack under GitOps (postgres, valkey, backend); secret.yaml excluded template

infra/argocd/applications/infisical-application.yaml

@@ -11,7 +11,9 @@ spec:
     targetRevision: HEAD
     directory:
       recurse: true
-      exclude: universal-auth-secret.yaml
+      # secret.yaml holds Infisical's own bootstrap secrets — applied out-of-band,
+      # committed here only as an emptied template. Never let ArgoCD apply it.
+      exclude: secret.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: infisical