add temporary credential recovery job

apps/recovery.yaml

@@ -0,0 +1,31 @@
+# TEMPORARY disaster-recovery application. This creates a short-lived
+# administrative ServiceAccount so a lost kubeconfig can be replaced through
+# the still-working Argo CD control plane. Remove this file and apps/recovery/
+# immediately after access is restored; the finalizer then deletes everything.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: credential-recovery
+  namespace: argocd
+  finalizers:
+    # Cascading deletion is essential here: it removes the temporary
+    # cluster-admin binding rather than leaving privileged access behind.
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+
+  source:
+    repoURL: https://tea.ahmza.com/ahmza.com/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/recovery
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: credential-recovery
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true