chore(iam): retire Authentik

Zitadel is running and has provisioned OIDC clients for all 12 consumers
(state.json: kubernetes, paperless, forgejo, argocd, grafana, immich, minio,
vault, poimen, api-gw, queue-sqs, homarr). Authentik's remaining job was to
serve until the last consumer moved.

Remove every Authentik artifact from GitOps:
- ArgoCD Application `authentik` and its Helm values
- ArgoCD Application `iam-jobs` (provisioner RBAC + migration job)
- ArgoCD Application `oidc-bootstrap` (one-shot apiserver restart)
- authentik-db CNPG cluster definition
- authentik-secrets SOPS file and secret-generator entry
- Ingress rule, cloudflared tunnel hostname, CoreDNS rewrite
- Prometheus alerts and ServiceMonitor
- admin OIDC ClusterRoleBinding provisioning binding
- scripts/iam/provision-rbac.py (the Authentik provisioner)

The chart repo https://charts.goauthentik.io is removed from the AppProject.

Kube-apiserver OIDC and consumer configs are switched to Zitadel in the
local cluster-config (gitignored) and applied separately via talosctl.

k8s/apps/cloudflared/configmap.yaml

@@ -53,8 +53,4 @@ data:
       # even though the DNS CNAME points at the tunnel.
       - hostname: zitadel.riotpiao.com
         service: https://zitadel.riotpiao.com
-      # AUTHENTIK. Same reasoning as ZITADEL: a hostname absent from this table
-      # gets 404 from the connector. CoreDNS rewrites the name to ingress-nginx.
-      - hostname: authentik.riotpiao.com
-        service: https://authentik.riotpiao.com
       - service: http_status:404

k8s/apps/cloudflared/deployment.yaml

@@ -16,7 +16,7 @@ spec:
       # Ingress-nginx forces HTTPS (force-ssl-redirect), so cloudflared must
       # dial https://<hostname> and trust homelab-ca or the TLS handshake fails
       # with "certificate signed by unknown authority". Same pattern as
-      # authentik-values.yaml: merge the system bundle with homelab-ca.crt.
+      # iam values: merge the system bundle with homelab-ca.crt.
       initContainers:
         - name: merge-ca-certs
           image: debian:bookworm