add PreSync hook + sync-wave for fully automated on first sync

manifests/secrets.example.yaml

@@ -9,6 +9,9 @@ kind: Secret
 metadata:
   name: nextgen-be-db
   namespace: nextgen-be
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "-2"
 type: Opaque
 stringData:
   # Get this value with:
@@ -20,6 +23,9 @@ kind: Secret
 metadata:
   name: nextgen-be-jwt
   namespace: nextgen-be
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "-2"
 type: Opaque
 stringData:
   # Generate with: openssl rand -hex 32
@@ -30,6 +36,9 @@ kind: Secret
 metadata:
   name: nextgen-be-radius
   namespace: nextgen-be
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "-2"
 type: Opaque
 stringData:
   # Must match the shared secret configured on the FreeRADIUS side