Fix kan ordering so it preceeds secret creation

.gitignore

@@ -5,4 +5,4 @@ talosconfig
 terraform/.terraform/
 terraform/.terraform.lock.hcl
 terraform.tfstate
-terraform/terraform.tfvars
+# terraform/terraform.tfvars is intentionally NOT ignored - zone ID is not sensitive

charts/kan/templates/external-secret.yaml

@@ -3,6 +3,8 @@ kind: ExternalSecret
 metadata:
   name: kan-secrets
   namespace: kan
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
 spec:
   refreshInterval: 1h
   secretStoreRef: