fix(iam,edge): freeze first-boot and wire the WireGuard CIDR variable

Zitadel first boot completed on 2026-10-26, so set FirstInstance.Skip: true and
initJob.enabled: false. Without Skip, every sync re-runs machinekeyWriter and
silently rotates the iam-admin key that terraform/zitadel authenticates with.

Also wire wireguard_allowed_cidr into the WireGuard security-group rule; the
variable was declared but the rule still used relay_admin_cidr, which blocks
the homelab peer unless its egress address happens to match the operator CIDR.

k8s/infra/iam/zitadel-values.yaml

@@ -32,6 +32,15 @@ zitadel:
     TLS:
       Enabled: false
 
+    # First boot is COMPLETE (2026-10-26): the instance, the system org and the
+    # `iam-admin` machine key all exist. Skip stops the setup hook from running
+    # the first-instance step again. Without it, every sync re-runs the
+    # machinekeyWriter, which silently rotates the iam-admin key Terraform
+    # reads and breaks the next `terraform apply` in terraform/zitadel.
+    # Never set this back to false.
+    FirstInstance:
+      Skip: true
+
   # Rendered into a Secret by the chart; read by pods and init jobs alike.
   masterkeySecretName: zitadel-masterkey
 
@@ -98,7 +107,13 @@ postgresql:
 # CNPG already created the database, the `app` user and its grants, so the init
 # job runs only the ZITADEL-internal step. Running the full default command
 # would try to create a database and a superuser it does not own.
+#
+# enabled: false after the first successful boot (2026-10-26). The schema is in
+# place; the init hook has nothing left to do and re-running it on every sync
+# only adds a PreSync failure surface. Re-enable it for a deliberate schema
+# upgrade, then set it back to false.
 initJob:
+  enabled: false
   command: "zitadel"
   activeDeadlineSeconds: 600
 

terraform/edge/tencent.tf

@@ -56,8 +56,12 @@ resource "tencentcloud_security_group_rule" "wireguard" {
   type              = "ingress"
   ip_protocol       = "udp"
   port_range        = tostring(var.wireguard_port)
-  cidr_ip           = var.relay_admin_cidr
-  policy            = "accept"
+  # The homelab dials outbound and has no static public address, so this is
+  # 0.0.0.0/0 by default. WireGuard authenticates every packet by public key,
+  # and an unauthenticated packet is dropped before it reaches the tunnel.
+  # Narrow this to the homelab egress CIDR when that address is stable.
+  cidr_ip = var.wireguard_allowed_cidr
+  policy  = "accept"
 }
 
 # cloud-init: WireGuard listener, forwarding sysctls, and Caddy for TLS.