fix(iam): make ZITADEL OIDC secrets and identity links IaC-owned (#85)

Co-authored-by: rock <[email protected]>

k8s/argocd/secrets/secret-generator.yaml

@@ -30,6 +30,16 @@ files:
     - paperless-ai-secrets.enc.yaml
     - memory-agent-oidc.enc.yaml
     - oauth2-credentials.enc.yaml
+    # ZITADEL OIDC client secrets for the consumer apps. These used to live only
+    # in the cluster, written by scripts/iam/zitadel-provision.py, so a rotation
+    # there left every consumer holding a stale secret and no git record of the
+    # real value. Declaring them here makes ArgoCD the owner and the rotation
+    # outcome reviewable in a diff.
+    - argocd-oidc.enc.yaml
+    - grafana-oidc.enc.yaml
+    - minio-oidc.enc.yaml
+    - immich-oidc.enc.yaml
+    - paperless-oidc.enc.yaml
     - forgejo-registry-token.enc.yaml
     - pi-sandbox-secrets.enc.yaml
     - etcd-defrag-creds.enc.yaml