fix(iam,edge): freeze first-boot and wire the WireGuard CIDR variable

Zitadel first boot completed on 2026-10-26, so set FirstInstance.Skip: true and
initJob.enabled: false. Without Skip, every sync re-runs machinekeyWriter and
silently rotates the iam-admin key that terraform/zitadel authenticates with.

Also wire wireguard_allowed_cidr into the WireGuard security-group rule; the
variable was declared but the rule still used relay_admin_cidr, which blocks
the homelab peer unless its egress address happens to match the operator CIDR.

k8s/infra/iam/zitadel-values.yaml

@@ -32,6 +32,15 @@ zitadel:
     TLS:
       Enabled: false
 
+    # First boot is COMPLETE (2026-10-26): the instance, the system org and the
+    # `iam-admin` machine key all exist. Skip stops the setup hook from running
+    # the first-instance step again. Without it, every sync re-runs the
+    # machinekeyWriter, which silently rotates the iam-admin key Terraform
+    # reads and breaks the next `terraform apply` in terraform/zitadel.
+    # Never set this back to false.
+    FirstInstance:
+      Skip: true
+
   # Rendered into a Secret by the chart; read by pods and init jobs alike.
   masterkeySecretName: zitadel-masterkey
 
@@ -98,7 +107,13 @@ postgresql:
 # CNPG already created the database, the `app` user and its grants, so the init
 # job runs only the ZITADEL-internal step. Running the full default command
 # would try to create a database and a superuser it does not own.
+#
+# enabled: false after the first successful boot (2026-10-26). The schema is in
+# place; the init hook has nothing left to do and re-running it on every sync
+# only adds a PreSync failure surface. Re-enable it for a deliberate schema
+# upgrade, then set it back to false.
 initJob:
+  enabled: false
   command: "zitadel"
   activeDeadlineSeconds: 600