feat(iam): own the ZITADEL core objects in GitOps

The chart declares its ServiceAccount, ConfigMap, Role and RoleBinding as
pre-install/pre-upgrade Helm hooks with hook-delete-policy before-hook-creation.
ArgoCD maps those to PreSync and prunes them when a sync ends, so every sync
deleted the ServiceAccount and ConfigMap the ZITADEL Deployment mounts. New pods
failed with `serviceaccount "zitadel" not found`, leaving the IdP one restart
from an outage.

Add a zatadel-core Application owning hook-free copies, keeping them as ordinary
desired state that survives every sync. Prune is off for this path: deleting a
ServiceAccount here would recreate the outage.

The ConfigMap also carries the notification settings, pointing
DefaultInstance.SMTPConfiguration at the smtp-gotify relay, with
SMTPSenderAddressMatchesInstanceDomain false because the sender
[email protected] differs from the instance domain zatadel.riotpiao.com.

Drop the envVarsSecret approach: ZITADEL created no SMTP provider from those env
vars (no instance.smtp.config.added event).

k8s/argocd/apps/30-security.yaml

@@ -79,6 +79,39 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
+# ZITADEL core objects (ServiceAccount, Role, RoleBinding, ConfigMap).
+#
+# The chart declares these as pre-install/pre-upgrade Helm hooks, and ArgoCD
+# prunes hook resources when a sync ends. That deleted the ServiceAccount and
+# ConfigMap the ZITADEL Deployment references, so new pods failed to start with
+# `serviceaccount "zitadel" not found`. This Application owns hook-free copies,
+# which makes them ordinary desired state that survives every sync.
+#
+# Wave 2: before the zatadel chart itself, so the ServiceAccount exists by the
+# time its Deployment is created.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: zitadel-core
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    targetRevision: main
+    path: k8s/infra/zitadel-core
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: iam
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
 # Raw IAM support manifests: the SMTP -> Gotify notification relay that ZITADEL
 # points at, so verification and password-reset codes reach the phone. Wave 3
 # alongside ZITADEL itself; the Secret it reads is created by sops-secrets at