fix(minio): enable the OIDC identity provider on the tenant

MinIO ships identity_openid disabled by default. Every MINIO_IDENTITY_OPENID_*
value was already correct, but without MINIO_IDENTITY_OPENID_ENABLE=on the
whole block is inert: the console answered /api/v1/login with
{"loginStrategy":"form"} and never rendered an SSO button.

Also drop MINIO_IDENTITY_OPENID_CLAIM_PREFIX, which was declared with an empty
value. An empty prefix makes the claim resolver prepend nothing and then look
for a nested property that cannot exist, so omitting the key is correct.

ArgoCD owns this Tenant with selfHeal, so the change has to land in git to
survive; a direct kubectl apply was reverted within seconds.

k8s/infra/minio/minio-tenant.yaml

@@ -107,6 +107,13 @@ spec:
   # Use external URL for config fetch (hairpins through ingress-nginx); browser
   # redirects use public URLs embedded in the OIDC metadata response.
   env:
+    # MinIO ships identity_openid DISABLED by default, whatever else is set.
+    # Without this key every other MINIO_IDENTITY_OPENID_* value below is
+    # inert and the console advertises password login only — it answers
+    # /api/v1/login with {"loginStrategy":"form"} and never renders an SSO
+    # button, which is exactly the symptom this tenant showed.
+    - name: MINIO_IDENTITY_OPENID_ENABLE
+      value: "on"
     - name: MINIO_IDENTITY_OPENID_CONFIG_URL
       # Must use external URL — well-known response contains external issuer/jwks_uri.
       # MinIO validates issuer in JWT matches well-known issuer. Internal URL = mismatch.
@@ -121,8 +128,9 @@ spec:
           key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
     - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
       value: "groups"
-    - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX
-      value: ""
+    # An empty claim prefix is worse than no key: it makes the claim resolver
+    # prepend nothing and then look for a nested property that cannot exist.
+    # Omit the key entirely unless a real prefix is needed.
     - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
       value: "https://minio.riotpiao.com/oauth_callback"
     - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME