chore(iam): retire Authentik

Zitadel is running and has provisioned OIDC clients for all 12 consumers
(state.json: kubernetes, paperless, forgejo, argocd, grafana, immich, minio,
vault, poimen, api-gw, queue-sqs, homarr). Authentik's remaining job was to
serve until the last consumer moved.

Remove every Authentik artifact from GitOps:
- ArgoCD Application `authentik` and its Helm values
- ArgoCD Application `iam-jobs` (provisioner RBAC + migration job)
- ArgoCD Application `oidc-bootstrap` (one-shot apiserver restart)
- authentik-db CNPG cluster definition
- authentik-secrets SOPS file and secret-generator entry
- Ingress rule, cloudflared tunnel hostname, CoreDNS rewrite
- Prometheus alerts and ServiceMonitor
- admin OIDC ClusterRoleBinding provisioning binding
- scripts/iam/provision-rbac.py (the Authentik provisioner)

The chart repo https://charts.goauthentik.io is removed from the AppProject.

Kube-apiserver OIDC and consumer configs are switched to Zitadel in the
local cluster-config (gitignored) and applied separately via talosctl.

k8s/infra/databases/authentik-db.yaml

@@ -1,38 +0,0 @@
-# Dedicated CNPG Postgres for Authentik (GitOps, wave 2 — before authentik w3).
-# CNPG generates secret `authentik-db-app` + service `authentik-db-rw` in ns iam;
-# authentik-values reads them locally (no cross-ns secret copy).
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: authentik-db
-  namespace: iam
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  instances: 3
-  imageName: ghcr.io/cloudnative-pg/postgresql:16.2
-  bootstrap:
-    initdb:
-      database: authentik
-      owner: app
-      encoding: UTF8
-      localeCollate: C
-      localeCType: C
-  enableSuperuserAccess: false
-  resources:
-    requests: { memory: "512Mi", cpu: "250m" }
-    limits: { memory: "2Gi", cpu: "1" }
-  storage:
-    size: 10Gi
-    storageClass: longhorn-cnpg
-  monitoring:
-    enablePodMonitor: true
-  affinity:
-    # preferred + tolerations: HA across nodes without deadlocking a partly-
-    # schedulable 3-CP (same as forgejo-db).
-    podAntiAffinityType: preferred
-    topologyKey: kubernetes.io/hostname
-    tolerations:
-      - key: node-role.kubernetes.io/control-plane
-        operator: Exists
-        effect: NoSchedule

k8s/infra/databases/kustomization.yaml

@@ -6,7 +6,6 @@ kind: Kustomization
 # deployed into it. paperless ns declared in namespaces.yaml above.
 resources:
   - namespaces.yaml
-  - authentik-db.yaml
   - zitadel-db.yaml
   - temporal-db.yaml
   - paperless-db.yaml

k8s/infra/databases/namespaces.yaml

@@ -1,7 +1,7 @@
 # DB clusters are wave 2 — their namespaces must exist first (their apps that
 # would CreateNamespace run later, w3/w8). Declared here so the databases App
-# creates them. authentik/vault/temporal/paperless CreateNamespace=true then
-# no-ops. poimen namespace created by poimen-root app (wave 7).
+# creates them. vault/temporal/paperless CreateNamespace=true then no-ops.
+# poimen namespace created by poimen-root app (wave 7).
 apiVersion: v1
 kind: Namespace
 metadata: