feat(iam): wire all 9 consumer manifests to Zitadel OIDC

- Replace Authentik issuer/auth/token/userinfo URLs with Zitadel endpoints
  in grafana, minio, paperless-ai, paperless-ai-new, homarr, argocd, blackbox
- Write Zitadel client IDs/secrets into plain manifests and SOPS secrets
  (grafana, minio, paperless, homarr)
- Adopt homarr-oidc into SOPS (homarr-auth-oidc.enc.yaml)
- Add homarr to SECRET_MAP and remove from MANUAL_ONLY in zitadel-provision.py
- Make client-id regex idempotent for repeated runs (minio, paperless)
- Fix cloudflared init container CA mount path (homelab-ca.crt -> ca.crt)
- Remove Authentik ingress and cloudflared tunnel entry

k8s/apps/paperless/paperless-ai-new.yaml

@@ -49,9 +49,9 @@ spec:
               echo "[init] Fetching JWT token from Authentik for paperless-ai-agent..."
               
               # Get JWT token via client_credentials grant
-              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+              TOKEN_RESPONSE=$(curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
                 -d "grant_type=client_credentials" \
-                -d "client_id=paperless-ai-agent" \
+                -d "client_id=396757803559027071" \
                 -d "client_secret=29skAhE0tBzWn0qrPvmPTQMva0joFjcCr7msDQr_VXQ" \
                 -d "scope=openid llm:inference" 2>/dev/null)
               

k8s/apps/paperless/paperless-ai.yaml

@@ -43,9 +43,9 @@ spec:
               
               # Get JWT token via client_credentials grant
               # Client secret sourced from environment (injected from paperless-ai-config Secret)
-              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+              TOKEN_RESPONSE=$(curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
                 -d "grant_type=client_credentials" \
-                -d "client_id=paperless-ai-agent" \
+                -d "client_id=396757803559027071" \
                 -d "client_secret=${LLM_AUTH_CLIENT_SECRET}" \
                 -d "scope=openid llm:inference" 2>/dev/null)