fix: OpenViking sync-wave deadlock - move ExternalSecret ordering inside Application

Remove resource-level sync-wave annotations that caused ArgoCD deadlock.
The wave 8 annotation was meant for platform-level ordering (apps-of-apps)
but was incorrectly applied to individual resources within the Application.

This caused ArgoCD to apply Deployment (wave 0) before ExternalSecret (wave 8),
resulting in CreateContainerConfigError since the pod needed the secret first.

Changes:
- namespace.yaml: Remove sync-wave annotation, add clarifying comment
- externalsecret.yaml: Change sync-wave from 8 to -1 (must sync before Deployment at wave 0)
- application.yaml: Remove sync-wave annotation, document as platform-level only in comments

This ensures:
1. ExternalSecret syncs first (wave -1)
2. Deployment uses it immediately (implicit wave 0)
3. No deadlock

Task: t_3906c41a

cluster/platform/openviking/namespace.yaml

@@ -3,6 +3,6 @@ kind: Namespace
 metadata:
   name: openviking
   annotations:
-    # Wave 8: OpenViking deployment (after Harbor at Wave 7)
+    # Wave 8 (platform-level): OpenViking deployment (after Harbor at Wave 7)
+    # This is documentation only - sync-wave at Application level, not resource level
     # Depends on: cert-manager, nginx-ingress, External Secrets Operator
-    argocd.argoproj.io/sync-wave: "8"