feat(argocd): enroll kadans-jobs — the Kadans analysis-jobs façade

kadans-jobs is the tier-2 (homelab, 24/7) piece of the Kadans topology: a job
queue plus the store of published analysis results, which decouples the product
from the volatile Mac worker. Its chart was just realigned on the new-app
runbook conventions (pi1, host kadans-jobs.arcodange.lab, websecure +
letsencrypt + localIp@file), so it is ready to be synced.

org: arcodange — the repo does not live under the default arcodange-org.
Digest-based image-updater annotations follow the fleet pattern; the
cluster-wide ImageUpdater CR (namePattern "*", useAnnotations) picks them up,
so there is no per-app CR to maintain. The image is already in the registry.

No postgres/iac/terraform.tfvars entry, on purpose: the façade runs a memory
store in v0, so it needs neither a database nor Vault. That is the runbook's
degraded mode and it is our current target — the DB, the Vault JWT role and the
app's own iac/ will land together with the Postgres store.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_013ws8L74dVZmp97Wu36fm8j

argocd/values.yaml

@@ -44,6 +44,11 @@ gitea_applications:
     annotations:
       argocd-image-updater.argoproj.io/image-list: kadans=gitea.arcodange.lab/arcodange/kadans:latest
       argocd-image-updater.argoproj.io/kadans.update-strategy: digest
+  kadans-jobs:
+    org: arcodange
+    annotations:
+      argocd-image-updater.argoproj.io/image-list: kadans-jobs=gitea.arcodange.lab/arcodange/kadans-jobs:latest
+      argocd-image-updater.argoproj.io/kadans-jobs.update-strategy: digest
 
 argocd_image_updater_chart_values:
   config: