feat(iam): wire all 9 consumer manifests to Zitadel OIDC

- Replace Authentik issuer/auth/token/userinfo URLs with Zitadel endpoints
  in grafana, minio, paperless-ai, paperless-ai-new, homarr, argocd, blackbox
- Write Zitadel client IDs/secrets into plain manifests and SOPS secrets
  (grafana, minio, paperless, homarr)
- Adopt homarr-oidc into SOPS (homarr-auth-oidc.enc.yaml)
- Add homarr to SECRET_MAP and remove from MANUAL_ONLY in zitadel-provision.py
- Make client-id regex idempotent for repeated runs (minio, paperless)
- Fix cloudflared init container CA mount path (homelab-ca.crt -> ca.crt)
- Remove Authentik ingress and cloudflared tunnel entry

k8s/apps/cloudflared/configmap.yaml

@@ -33,8 +33,6 @@ data:
     ingress:
       - hostname: paperless.riotpiao.com
         service: https://paperless.riotpiao.com
-      - hostname: authentik.riotpiao.com
-        service: https://authentik.riotpiao.com
       - hostname: img.riotpiao.com
         service: https://img.riotpiao.com
       - hostname: riotpiao.com

k8s/apps/cloudflared/deployment.yaml

@@ -26,7 +26,7 @@ spec:
           command:
             - sh
             - -c
-            - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/homelab-ca.crt) > /merged/ca-bundle.crt
+            - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/ca.crt) > /merged/ca-bundle.crt
           volumeMounts:
             - name: homelab-ca
               mountPath: /homelab-ca

k8s/apps/homarr/homarr-values.yaml

@@ -29,12 +29,12 @@ replicaCount: 1
 # Chart supports these via top-level env dict (not array)
 env:
   AUTH_PROVIDERS: "oidc,credentials"
-  AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
+  AUTH_OIDC_ISSUER: "https://zitadel.riotpiao.com"
   # AUTH_OIDC_URI (authorize endpoint) is REQUIRED in addition to ISSUER — homarr
   # hides the "Sign in with Authentik" button entirely when it's absent (per the
   # authentik Homarr integration + homarr SSO docs). This was the missing var.
-  AUTH_OIDC_URI: "https://authentik.riotpiao.com/application/o/authorize/"
-  AUTH_OIDC_CLIENT_NAME: "Authentik"
+  AUTH_OIDC_URI: "https://zitadel.riotpiao.com/oauth/v2/authorize"
+  AUTH_OIDC_CLIENT_NAME: "Zitadel"
   AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
   AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
   AUTH_OIDC_AUTO_LOGIN: "false"

k8s/apps/paperless/paperless-ai-new.yaml

@@ -49,9 +49,9 @@ spec:
               echo "[init] Fetching JWT token from Authentik for paperless-ai-agent..."
               
               # Get JWT token via client_credentials grant
-              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+              TOKEN_RESPONSE=$(curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
                 -d "grant_type=client_credentials" \
-                -d "client_id=paperless-ai-agent" \
+                -d "client_id=396757803559027071" \
                 -d "client_secret=29skAhE0tBzWn0qrPvmPTQMva0joFjcCr7msDQr_VXQ" \
                 -d "scope=openid llm:inference" 2>/dev/null)
               

k8s/apps/paperless/paperless-ai.yaml

@@ -43,9 +43,9 @@ spec:
               
               # Get JWT token via client_credentials grant
               # Client secret sourced from environment (injected from paperless-ai-config Secret)
-              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+              TOKEN_RESPONSE=$(curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
                 -d "grant_type=client_credentials" \
-                -d "client_id=paperless-ai-agent" \
+                -d "client_id=396757803559027071" \
                 -d "client_secret=${LLM_AUTH_CLIENT_SECRET}" \
                 -d "scope=openid llm:inference" 2>/dev/null)