chore(iam): retire Authentik

Zitadel is running and has provisioned OIDC clients for all 12 consumers
(state.json: kubernetes, paperless, forgejo, argocd, grafana, immich, minio,
vault, poimen, api-gw, queue-sqs, homarr). Authentik's remaining job was to
serve until the last consumer moved.

Remove every Authentik artifact from GitOps:
- ArgoCD Application `authentik` and its Helm values
- ArgoCD Application `iam-jobs` (provisioner RBAC + migration job)
- ArgoCD Application `oidc-bootstrap` (one-shot apiserver restart)
- authentik-db CNPG cluster definition
- authentik-secrets SOPS file and secret-generator entry
- Ingress rule, cloudflared tunnel hostname, CoreDNS rewrite
- Prometheus alerts and ServiceMonitor
- admin OIDC ClusterRoleBinding provisioning binding
- scripts/iam/provision-rbac.py (the Authentik provisioner)

The chart repo https://charts.goauthentik.io is removed from the AppProject.

Kube-apiserver OIDC and consumer configs are switched to Zitadel in the
local cluster-config (gitignored) and applied separately via talosctl.

k8s/infra/monitoring/alerts/svc-authentik-rules.yaml

@@ -1,33 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: authentik-rules
-  namespace: iam
-spec:
-  groups:
-    - name: authentik.rules
-      interval: 15s
-      rules:
-        - alert: AuthentikHighErrorRate
-          expr: |
-            (
-              sum(rate(authentik_http_requests_total{status=~"5.."}[5m]))
-              /
-              sum(rate(authentik_http_requests_total[5m]))
-            ) > 0.05
-          for: 10m
-          labels:
-            severity: warning
-          annotations:
-            summary: "High error rate on Authentik"
-            description: "5xx error rate exceeded 5% of total requests for 10 minutes. Value: {{ $value | humanizePercentage }}"
-
-        - alert: AuthentikOutpostDown
-          expr: |
-            authentik_outpost_total_up == 0
-          for: 5m
-          labels:
-            severity: warning
-          annotations:
-            summary: "Authentik outpost is down"
-            description: "Outpost {{ $labels.outpost_name }} (type: {{ $labels.outpost_type }}) has been offline for 5 minutes"

k8s/infra/monitoring/kustomization.yaml

@@ -7,7 +7,6 @@ kind: Kustomization
 resources:
   - alerts/ingress-alerts.yaml
   - alerts/svc-argocd-rules.yaml
-  - alerts/svc-authentik-rules.yaml
   - alerts/svc-zitadel-rules.yaml
   - alerts/svc-forgejo-rules.yaml
   - alerts/svc-grafana-rules.yaml
@@ -17,7 +16,6 @@ resources:
   - alerts/api-gateway-alerts.yaml
   - alerts/cag-kv-cache-rules.yaml
   - servicemonitors/argocd.yaml
-  - servicemonitors/authentik.yaml
   - servicemonitors/forgejo.yaml
   - servicemonitors/minio.yaml
   - servicemonitors/ingress-nginx.yaml

k8s/infra/monitoring/servicemonitors/authentik.yaml

@@ -1,18 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: authentik
-  namespace: monitoring
-  labels:
-    release: kube-prometheus-stack
-spec:
-  namespaceSelector:
-    matchNames:
-      - iam
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: authentik
-  endpoints:
-    - port: metrics
-      interval: 30s
-      scrapeTimeout: 10s