fix(argocd): point OIDC at the new Sentinel client_id

[BK1031]

The previous client (`XwwQhdCWZ9Cn`) lived in the sentinel Postgres database that got wiped during the gr-postgres recreate. Re-registering the ArgoCD app in Sentinel post-recovery produced a fresh auto-generated client_id (`b9OrCRXdo1VQ`).

After this merges

1. terraform-apply re-renders `argocd-cm` with the new `clientID`:
   ```bash
   gh workflow run terraform-apply.yml -f env=prod -R Gaucho-Racing/infrastructure
   ```
2. Rotate the matching clientSecret in the argocd namespace (the secret is deliberately out-of-Git, see the argocd module's header comment):
   ```bash
   kubectl -n argocd delete secret argocd-sentinel-oidc
   kubectl -n argocd create secret generic argocd-sentinel-oidc \
   --from-literal=oidc.clientSecret=''
   kubectl -n argocd label secret argocd-sentinel-oidc \
   app.kubernetes.io/part-of=argocd
   kubectl -n argocd rollout restart deploy argocd-server
   ```
3. Try to log in via argocd.gauchoracing.com → Sentinel SSO → ArgoCD; admin-group users land on `role:admin`, everyone else `role:readonly`.

Test plan

• `terraform validate` + `fmt -check`
• After apply: `kubectl -n argocd get cm argocd-cm -o jsonpath='{.data.oidc\.config}' | grep clientID` returns `b9OrCRXdo1VQ`
• After secret rotation + rollout: ArgoCD login flow completes through Sentinel without `invalid_client` errors

[github-actions]

Terraform plan: prod

step	result
fmt	success
init	success
validate	success
plan	failure

plan output