feat(iam): wire all 9 consumer manifests to Zitadel OIDC

- Replace Authentik issuer/auth/token/userinfo URLs with Zitadel endpoints
  in grafana, minio, paperless-ai, paperless-ai-new, homarr, argocd, blackbox
- Write Zitadel client IDs/secrets into plain manifests and SOPS secrets
  (grafana, minio, paperless, homarr)
- Adopt homarr-oidc into SOPS (homarr-auth-oidc.enc.yaml)
- Add homarr to SECRET_MAP and remove from MANUAL_ONLY in zitadel-provision.py
- Make client-id regex idempotent for repeated runs (minio, paperless)
- Fix cloudflared init container CA mount path (homelab-ca.crt -> ca.crt)
- Remove Authentik ingress and cloudflared tunnel entry

k8s/apps/cloudflared/configmap.yaml

@@ -33,8 +33,6 @@ data:
     ingress:
       - hostname: paperless.riotpiao.com
         service: https://paperless.riotpiao.com
-      - hostname: authentik.riotpiao.com
-        service: https://authentik.riotpiao.com
       - hostname: img.riotpiao.com
         service: https://img.riotpiao.com
       - hostname: riotpiao.com

k8s/apps/cloudflared/deployment.yaml

@@ -26,7 +26,7 @@ spec:
           command:
             - sh
             - -c
-            - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/homelab-ca.crt) > /merged/ca-bundle.crt
+            - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/ca.crt) > /merged/ca-bundle.crt
           volumeMounts:
             - name: homelab-ca
               mountPath: /homelab-ca