feat(iam): rock user with Forgejo email, email password recovery, encrypt SMTP creds

- provision-rbac.py: create rock user ([email protected]) matching Forgejo
- Email recovery flow: identification -> email stage -> password reset
- SMTP via Gmail (gotify-smtp secret, SOPS-encrypted)
- Recovery flow bound to brand for login page reset link
- minio-provision-paperless: add bucket creation, use quay.io/minio/mc

k8s/argocd/secrets/gotify-smtp-secrets.enc.yaml

@@ -1,30 +1,30 @@
-apiVersion: ENC[AES256_GCM,data:xUA=,iv:YH1WYnoXhxbeES3Dmo8ZrMDwFcwCykt6+Zn4YSgN4gc=,tag:t3bIWo/LetlQv4tJ0nJ2Sw==,type:str]
-kind: ENC[AES256_GCM,data:PJVzDTcT,iv:aRxvzLUuCzSDryOjA/v67csL6E2FcCpoK8aD7KNStno=,tag:cQgbowSTTV99nQ41yFOlsA==,type:str]
+apiVersion: ENC[AES256_GCM,data:sSc=,iv:ZS9n4dUNRQPmpUTP+VKGP43UcxT4iABZ7nzgXZvxdsQ=,tag:ZEkTcbLwfJdyinT9pTlRig==,type:str]
+kind: ENC[AES256_GCM,data:7UcVKqy8,iv:n+U2h/CNkIKiJ6u3wSPmh9S0XpAB26gjRaw2vCcsvkw=,tag:TzQoR1C2HnckpSLZuSeeKg==,type:str]
 metadata:
-    name: ENC[AES256_GCM,data:atkSiP0rjyuWFjs=,iv:l/48X9W9lrkAyw6Q/p39V775L6xbr0tOIFI4vjYrg+E=,tag:LZrQxN5h6T5tehFG8L9KFw==,type:str]
-    namespace: ENC[AES256_GCM,data:fbklNyooBeqsogKbeg==,iv:z2wLgl81q8xfzGGVQ9A4Pkst/zLmuZpyBzHrXzmVfm4=,tag:QKJik4IWc4nrOBINjGCxvQ==,type:str]
-type: ENC[AES256_GCM,data:bfAFBd/7,iv:9/W3X1KefqDAsurIatT6kBuEIQvWVRTq4G9A+9ZfYKs=,tag:Optlb+gZ2udbqIOerqV2zQ==,type:str]
+    name: ENC[AES256_GCM,data:cmXlYpw3kvjcquE=,iv:asPdsoywWpSN45niiM/Rlc3ij2OFeQ9EgZ6BqEBmnzc=,tag:kIiT12cROfO/PjwRqP8tBQ==,type:str]
+    namespace: ENC[AES256_GCM,data:2TkMj1ufxznvL4BpwQ==,iv:+vMA1ZLeLzDfDDUFaURxZsMNG8At/zHIAPR2r43FsNU=,tag:narIeC9Gp7aW3ovc6Kimlw==,type:str]
+type: ENC[AES256_GCM,data:0mc/bJL1,iv:69PUMvrStYqI7Fp1ZtLSA4Enjyj/z7f77PeHZffPmME=,tag:cxChXpP18vYjuGp4JJWsTw==,type:str]
 stringData:
-    #ENC[AES256_GCM,data:RZaw/FNQZOf0F3+XfFmGW+4gjKXNdjrAbMRjBt4hptwk,iv:IEd/+Bsv/h08nKak+bcovNiohC7nNjEQ+QdtIFMUGng=,tag:zsF5ZQ3+5JijF4MU+RhnyA==,type:comment]
-    #ENC[AES256_GCM,data:ux3ONHnuI0uFEihElbLI1rKlrN91Pn0iLLZfmez0+t5d8yhH6OD3L/3oi6yHbdgD8bV90kRK/lw=,iv:7Ed+W/TeOY9Af8bKO0Fu3XOuaK8b0Hw70rwobfmosxM=,tag:Z0RbIOjdDroK0drC6P+Y8A==,type:comment]
-    host: ENC[AES256_GCM,data:YKgas/8hT5ZOGIW7O0c=,iv:WtBz1MFrwd6EgDDS5fMqtcVGIZGNLgbXnmkqlNWoXy8=,tag:+H9ARGPi5XocgZYp4oA3wA==,type:str]
-    port: ENC[AES256_GCM,data:f0hx,iv:HkSnJcCyzyfBTA39BNw+muhHTyrNLzzGxZ7M3bcLVu4=,tag:4+xL1xNyYPaV2b0mwnbQVQ==,type:str]
-    from: ENC[AES256_GCM,data:lqYqXxJuI4CAWPlX+5cltCdxqA==,iv:ZgZYySJXvjuTNIkMaDxynUJ6PFdp4fibqlgoA1vNDKE=,tag:vb/XKl2N1Hl5u7ndZXQvbg==,type:str]
-    user: ENC[AES256_GCM,data:ajljGVbRO//G,iv:E4Q0LGDCd5wnHc+Oq2A9ZhWGbCmkKlhllt922UmppIg=,tag:Cf4ft1JKFi9PaJEfPfq92Q==,type:str]
-    password: ENC[AES256_GCM,data:YNbtoiWLsQGl,iv:FJ3y1lWkqKkM8GVr7FZljAXJ331GkDgy4TenAbdIY3w=,tag:KIvhv+RL49ZMwWhYrU0SPA==,type:str]
-    notify-email: ENC[AES256_GCM,data:s5wRkDuaiflCyu4IyAnaocVPA3I=,iv:dK5PsweYa3JotYcDcz74DPNDXmhW5ngNEbY6JuG1ctg=,tag:/Dt2UoCtfau6qv0G7VzmrQ==,type:str]
+    #ENC[AES256_GCM,data:AV+01YHBJFUZg6UTx6iOOfWpFDK3+mOlgnWjkbSsLpjhM+U+Z0THZqPxRENDtcvCQMaWoYET0Puw0zkZ+2rO,iv:Gm43af/VVGax4aG3UvwuppECERUIza/xOgMUMNVihno=,tag:Js175M46l/ZXRqUX2yRebw==,type:comment]
+    #ENC[AES256_GCM,data:/sfalNCvjg5KHQNQafq6KCzUIC++WSw1e4QnhavcJ+Y5CjoBEAi6K50k,iv:7RyaZj2KRhG3TZyweg7GqMDM6D+kyqbxBgxrlI0XOnQ=,tag:gs+ION+iBLd90wD3j/27hQ==,type:comment]
+    host: ENC[AES256_GCM,data:lPOjBktggi6UeLxcBlg=,iv:AslugezYFHxKLo0uT69wZlHXQh/iRTf48f7JCE31JGw=,tag:hIP411PgKdS04Mn9XCI7XA==,type:str]
+    port: ENC[AES256_GCM,data:Bun8,iv:pN/is+yEsXloHDyLnwPDQtubgpGfRkbd64aBKdOaCNQ=,tag:3/uRpYC4g53N/Il8Y65nMQ==,type:str]
+    from: ENC[AES256_GCM,data:8Gfzv+/No/yA/gYWjLPssBaiNw==,iv:b+DHtr7M7NQu7r+/3ELzUyxgjaL7n8oJ1efd0hzW4gM=,tag:wGiz6lc402XocVWNeMXbNA==,type:str]
+    user: ENC[AES256_GCM,data:TyNmWUjK+e/hhOy0Gu5LCBTsYqs=,iv:mkR6Cw4bX1a+dPFba1YM0Jczsp9BX9kJQ3d+yvqy7FY=,tag:Tdurupy0nBLmYv+EgopQ5g==,type:str]
+    password: ENC[AES256_GCM,data:cLq9EK+ayJNxpFTGlVE=,iv:LwZW0BJwlSyVByJ0Ao1+aT/VwYR84VbL4XjcY8MFcWA=,tag:lLNwrosNon9mRTE2bEZgMA==,type:str]
+    notify-email: ENC[AES256_GCM,data:9Cqv2CRvPngmmO5x9/07o4w0rsY=,iv:GOORTL3Npx1DSl9wJIFj8qMMyAnJvrS8TQpQkjo3/48=,tag:mKdDc9xNTznyS+ktw8Y6DA==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQlJVekcwb01ESnhxSE9m
-            MzliVmlaYUttZVdiMDVtMlQ2L29LMXBWRzBZCkxRMi9RcE5LMzQ1MHFqUUxLaFZo
-            MUZ2UTg5eUNsMFVmenlhL2F3NDd0akkKLS0tIGFwbUUrSGFUTDFVOWlxM3V1bVdy
-            RUVVNDFMRHZCSWptdSt1bFVoN2JPWVkKXMlrJNPbm7Sj9vd/H3o6iqPRLy4LyjVe
-            xJyh9vn9RCwS9Jr6BN2Q9P2UZfTGwvIYc6zdmV+b2uRwvi4t4lMsBA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPZDQ5emV6S0podmt3bVB1
+            ZUU3U0RhWlY0OUdoR3NuaWd4eWx0bGw2clRrCjRQUGFBUVJrQ1hTeXlubkR3dENX
+            TUNLOGE3cnNub05iRTgzdVRIZU5hTUEKLS0tIFp3YU04eWNNM2hYMmxsK3A5bjVl
+            R2RzZnRINUgvNTBkREc1bVJtK0NBb00KfeMwARTyT8ue435GN5kZVyXH/NLoR9hl
+            g1oq5Dj1b+PS6/+7MfDgG+reSTP3pH4ewaUrF+Tm8aLy14pSwJDWEA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-09-10T13:31:00Z"
-    mac: ENC[AES256_GCM,data:g1YjOANlnvXErPqtDdDjRB9yTUiGEhX8QDkmf1aLfQBwoXbGUpoPIZibF8A4cAL1yUSZ2rD4l9TIe9nK8U3oF4WiKXf9u0bFK2g//bOv2A5JPewwmzoazkjIDXcJ/76nOQ5c+v8/r5tUG4c0SyzBH/gFP0D0+P5Yo3SEXjTxj2w=,iv:gW+AUwwAWkXZ+aLBXjjNDZw8VEraMpSE16RJGQc/L5g=,tag:DM/DUtil/7yLhfGYQXKFGA==,type:str]
+    lastmodified: "2026-09-12T14:43:08Z"
+    mac: ENC[AES256_GCM,data:zTdanQNaCKEQ0CYd7z68PAbnyy704To9ykdNx8gRth1wjjgYHqLTOJ739sxu504EAP3UvPDw1zO8rZhpf0PTeuBUIml1+PBkzzvFk7LMRqofGAp/yHe0xJH6pFAT/Rn2R1cymnuDIfXDdfPKVMEaT380AjqS78FJeMC4e1oroqw=,iv:M//b0yU+mmFXixLyl7k4JHHZB+3oauVjDYxYKbYTh2E=,tag:OUUAQ+MUf8xpa6Ivb0bQyA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2

k8s/infra/minio/minio-provision-paperless-job.yaml

@@ -59,7 +59,7 @@ spec:
               mountPath: /shared
       containers:
         - name: provision
-          image: minio/mc:latest
+          image: quay.io/minio/mc:latest
           volumeMounts:
             - name: shared
               mountPath: /shared
@@ -81,6 +81,9 @@ spec:
               mc alias set m http://minio-cluster-hl.storage.svc.cluster.local:9000 \
                 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
 
+              echo "Ensuring paperless bucket exists..."
+              mc mb --ignore-existing m/paperless
+
               echo "Checking for existing paperless-minio-creds secret..."
               if kubectl -n paperless get secret paperless-minio-creds >/dev/null 2>&1; then
                 ACCESS_KEY=$(kubectl -n paperless get secret paperless-minio-creds -o jsonpath='{.data.ACCESS_KEY}' | base64 -d)