fix: run ingress-nginx admission jobs as Argo CD sync hooks; fix front links

- ingress-nginx admission Job 2개는 ttlSecondsAfterFinished: 0으로 완료 즉시 사라져
  Argo CD가 영구 OutOfSync로 보고 selfHeal 때마다 다시 실행했다(2026-09-24 실측).
  Sync 훅(HookSucceeded 삭제)으로 돌린다.
- front 정적 페이지의 /api/readyz 링크(404)를 제거한다(api의 /readyz는 /api 아래가 아님).

workloads/demo-app/front.yaml

@@ -22,7 +22,7 @@ data:
     <!doctype html><html lang="ja"><meta charset="utf-8"><title>selfheal demo</title>
     <body style="font-family:system-ui;margin:2rem"><h1>selfheal demo front</h1>
     <p>container layer (AWS k8s) -&gt; VPN -&gt; VM layer (GCP legacy-api, PostgreSQL)</p>
-    <ul><li><a href="/api/orders">/api/orders</a></li><li><a href="/api/price/apple">/api/price/apple</a></li><li><a href="/api/readyz">/api/readyz</a></li></ul>
+    <ul><li><a href="/api/orders">/api/orders</a></li><li><a href="/api/price/apple">/api/price/apple</a></li><li><a href="/api/price/nothere">/api/price/nothere (404)</a></li></ul>
     </body></html>
 ---
 apiVersion: apps/v1

workloads/ingress-nginx/kustomization.yaml

@@ -16,3 +16,15 @@ patches:
       - op: add
         path: /spec/ports/1/nodePort
         value: 30443
+  # The admission Jobs have ttlSecondsAfterFinished: 0 and vanish after they complete, which Argo CD would report as
+  # OutOfSync forever (and re-run on every selfHeal). Run them as Sync hooks instead and let Argo CD delete them.
+  - target:
+      kind: Job
+      name: ingress-nginx-admission-.*
+      namespace: ingress-nginx
+    patch: |-
+      - op: add
+        path: /metadata/annotations
+        value:
+          argocd.argoproj.io/hook: Sync
+          argocd.argoproj.io/hook-delete-policy: HookSucceeded