feat(iam): wire all 9 consumer manifests to Zitadel OIDC

- Replace Authentik issuer/auth/token/userinfo URLs with Zitadel endpoints
  in grafana, minio, paperless-ai, paperless-ai-new, homarr, argocd, blackbox
- Write Zitadel client IDs/secrets into plain manifests and SOPS secrets
  (grafana, minio, paperless, homarr)
- Adopt homarr-oidc into SOPS (homarr-auth-oidc.enc.yaml)
- Add homarr to SECRET_MAP and remove from MANUAL_ONLY in zitadel-provision.py
- Make client-id regex idempotent for repeated runs (minio, paperless)
- Fix cloudflared init container CA mount path (homelab-ca.crt -> ca.crt)
- Remove Authentik ingress and cloudflared tunnel entry

k8s/apps/homarr/homarr-values.yaml

@@ -29,12 +29,12 @@ replicaCount: 1
 # Chart supports these via top-level env dict (not array)
 env:
   AUTH_PROVIDERS: "oidc,credentials"
-  AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
+  AUTH_OIDC_ISSUER: "https://zitadel.riotpiao.com"
   # AUTH_OIDC_URI (authorize endpoint) is REQUIRED in addition to ISSUER — homarr
   # hides the "Sign in with Authentik" button entirely when it's absent (per the
   # authentik Homarr integration + homarr SSO docs). This was the missing var.
-  AUTH_OIDC_URI: "https://authentik.riotpiao.com/application/o/authorize/"
-  AUTH_OIDC_CLIENT_NAME: "Authentik"
+  AUTH_OIDC_URI: "https://zitadel.riotpiao.com/oauth/v2/authorize"
+  AUTH_OIDC_CLIENT_NAME: "Zitadel"
   AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
   AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
   AUTH_OIDC_AUTO_LOGIN: "false"