Extension proxy keeps using stale secret values after secret rotation

[saidsef]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

When an extension is configured with a secret reference in a header (e.g. value: '$my-api-key'), rotating the underlying secret in argocd-secret has no effect on the running proxy. The proxy keeps forwarding the old (or unresolved literal) value until either the ExtensionConfig itself is modified or the server is restarted.

This is particularly painful when using something like External Secrets Operator, where secrets may be populated or rotated after initial startup — the proxy never picks up the resolved values at all, and requests to the backend fail with 401s indefinitely.

The root cause is in watchSettings() in server/server.go: it only calls UpdateExtensionRegistry() when ExtensionConfig (ConfigMap data) changes, and completely ignores changes to settings.Secrets. Since ReplaceMapSecrets() is called inside UpdateExtensionRegistry(), the secret substitution never runs unless something else triggers a rebuild.

To Reproduce

1. Configure a proxy extension with a secret reference in a header:

   extensions:
   - name: my-api
     backend:
       services:
       - url: https://api.example.com
         headers:
         - name: Authorization
           value: '$my-api-key'

2. Store the token in argocd-secret:

   stringData:
     my-api-key: Bearer old-token

3. Send a request through the extension — it works, the backend receives Bearer old-token.
4. Rotate the secret (update argocd-secret with Bearer new-token).
5. Send another request — the backend still receives Bearer old-token.
6. The only way to force an update is to either touch ExtensionConfig or restart the server.

Expected behavior

Updating a secret referenced by an extension config should cause the proxy registry to rebuild and start using the new value, the same way editing ExtensionConfig does.

Version

argocd-server: v3.4.1

Logs

No errors logged — the proxy silently continues using the stale value.