[Feature]: Support Argo CD repo auth via SSH/GitHub App and clarify PAT best practices #246

Summary

kubara currently bootstraps Argo CD repository access mainly via HTTPS username + PAT/password.
Additional non-personal auth options should be supported, and PAT usage guidance should be clarified.

🧩 Type of Issue

✨ Feature request

🔍 Description

Current setup:

• Argo CD repo access is configured using HTTPS credentials (username + password/PAT).

Problem:

• PAT commonly means Personal Access Token, and in many setups it is tied to an individual user account.
• This creates a risk of person-bound access in platform automation.

Requested changes:

1. Add additional Argo CD Git auth modes:

• SSH deploy key
• GitHub App

2. Keep existing HTTPS PAT mode fully supported (backward compatible).

3. Improve documentation and generated env guidance:

• State clearly that PAT usually means Personal Access Token and is often user-bound.
• Recommend a technical/machine account when PAT mode is used.
• Clarify that ARGOCD_GIT_USERNAME can be provider-dependent and should be set to the technical account username.

4. Include SSH host verification requirements in scope:

• Cover handling of trusted SSH host keys (known_hosts / Unknown SSH Hosts).
• Keep secure defaults (strict host verification).

Acceptance criteria

• Existing PAT-based setups continue to work unchanged.
• SSH-based repo auth can be bootstrapped successfully.
• GitHub-App-based repo auth can be bootstrapped successfully.
• Docs/.env guidance explicitly recommends technical account + PAT when PAT mode is used.
• Docs clarify username behavior for PAT mode (provider-dependent).
• SSH host key requirements are documented, including failure behavior when host keys are missing.
• Tests cover secret generation/validation for all supported auth modes.

🧪 Steps to Reproduce (for bugs)

N/A (feature + documentation improvement)

✅ Checklist

• I have searched existing issues
• I am using the latest version of Kubara
• This is not a duplicate

🔗 Related Issues / References

• https://argo-cd.readthedocs.io/en/stable/user-guide/private-repositories/
• https://argo-cd.readthedocs.io/en/stable/user-guide/private-repositories/#unknown-ssh-hosts
• https://argo-cd.readthedocs.io/en/stable/user-guide/commands/argocd_repo_add/

📎 Additional Context / Logs

This combines capability and guidance:

• capability: SSH + GitHub App support
• guidance: safer PAT usage via technical account instead of personal account
• security scope for SSH: trusted host key handling (Unknown SSH Hosts)