feat(iam): wire all 9 consumer manifests to Zitadel OIDC

- Replace Authentik issuer/auth/token/userinfo URLs with Zitadel endpoints
  in grafana, minio, paperless-ai, paperless-ai-new, homarr, argocd, blackbox
- Write Zitadel client IDs/secrets into plain manifests and SOPS secrets
  (grafana, minio, paperless, homarr)
- Adopt homarr-oidc into SOPS (homarr-auth-oidc.enc.yaml)
- Add homarr to SECRET_MAP and remove from MANUAL_ONLY in zitadel-provision.py
- Make client-id regex idempotent for repeated runs (minio, paperless)
- Fix cloudflared init container CA mount path (homelab-ca.crt -> ca.crt)
- Remove Authentik ingress and cloudflared tunnel entry

k8s/bootstrap/phase4-argocd/argocd-values.yaml

@@ -138,12 +138,12 @@ configs:
     #   cicd  — automation-only; apiKey (token) for the CD pipeline, no UI login.
     accounts.rock: apiKey,login
     accounts.cicd: apiKey
-    # Authentik OIDC. clientSecret pulled from the argocd `oidc-secret` Secret
-    # (created by authentik-provision). The groups claim drives RBAC below.
+    # Zitadel OIDC. clientSecret pulled from the argocd `oidc-secret` Secret.
+    # The groups claim drives RBAC below.
     oidc.config: |
-      name: Authentik
-      issuer: https://authentik.riotpiao.com/application/o/argocd/
-      clientID: argocd
+      name: Zitadel
+      issuer: https://zitadel.riotpiao.com
+      clientID: 396757801210282367
       clientSecret: $oidc-secret:client-secret
       requestedScopes:
         - openid
@@ -158,7 +158,7 @@ configs:
     server.insecure: false
 
   # RBAC. local `admin` + `rock` + the `cicd` pipeline account all get role:admin;
-  # the Authentik `homelab-admins` group (rock is a member) maps to admin so SSO
+  # the Zitadel `homelab-admins` role (rock is a member) maps to admin so SSO
   # logins are admin too.
   rbac:
     policy.default: role:readonly