feat(gotify): put the Gotify UI behind ZITADEL single sign-on

Gotify has no OIDC support, so it cannot validate a ZITADEL token itself. Put
oauth2-proxy in front of it and let nginx ask the proxy for every request.

The Gotify REST API keeps its own client-token check. /message, /application,
/client, /user, /version, /stream and /health are skipped by the proxy, so
Forgejo webhooks, the harness, poimen-sender and the Android client keep working
without a browser session. Only the web UI requires SSO.

The /oauth2 path needs its own ingress: the auth_request annotation would
otherwise also guard /oauth2/start, and the login entry point would demand a
login first.

The client id and secret come from project role provisioning:
`zitadel-provision.py apply` now creates the `gotify` OIDC app, and the secret is
SOPS-encrypted under k8s/argocd/secrets.

Gotify's own login remains behind the proxy. ZITADEL decides who reaches the
service, Gotify decides what that person may do inside it.

k8s/apps/gotify/oauth2-proxy-ingress.yaml

@@ -0,0 +1,22 @@
+# The proxy needs its own ingress path. nginx auth_request also guards
+# /oauth2/start and /oauth2/callback, which would loop: the login entry point
+# would itself require a login. A longer path match sends /oauth2 to the proxy
+# directly, and the prefix rule on the gotify ingress handles everything else.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gotify-oauth2
+  namespace: notifications
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: gotify.riotpiao.com
+      http:
+        paths:
+          - path: /oauth2
+            pathType: Prefix
+            backend:
+              service:
+                name: gotify-oauth2-proxy
+                port:
+                  number: 4180