feat(config): add tokenUrl, clientId, clientSecret to auth config (#17)
Closes homelab#12 (P3.7)
## Changes
- `AuthConfig`: added `TokenURL`, `ClientID`, `ClientSecret` fields
- `loader.go`: reads `tokenUrl`/`clientId` from YAML, `ClientSecret` from `AUTH_CLIENT_SECRET` env
- `deployment.yaml`: `AUTH_CLIENT_SECRET` from `api-gw-client-secret` Secret (optional)
- `gateway-config-secret.enc.yaml` + `configmap.yaml`: added `tokenUrl` and `clientId`
## Secret never in YAML
`clientSecret` deliberately omitted from YAML struct. Loaded from env only.
## Tests
3 tests: full config load, env-only secret, backward compat (missing fields = zero).
Co-authored-by: poimen <[email protected]>