feat(iam): wire all 9 consumer manifests to Zitadel OIDC

- Replace Authentik issuer/auth/token/userinfo URLs with Zitadel endpoints
  in grafana, minio, paperless-ai, paperless-ai-new, homarr, argocd, blackbox
- Write Zitadel client IDs/secrets into plain manifests and SOPS secrets
  (grafana, minio, paperless, homarr)
- Adopt homarr-oidc into SOPS (homarr-auth-oidc.enc.yaml)
- Add homarr to SECRET_MAP and remove from MANUAL_ONLY in zitadel-provision.py
- Make client-id regex idempotent for repeated runs (minio, paperless)
- Fix cloudflared init container CA mount path (homelab-ca.crt -> ca.crt)
- Remove Authentik ingress and cloudflared tunnel entry

k8s/infra/monitoring/blackbox-exporter-values.yaml

@@ -43,8 +43,8 @@ serviceMonitor:
       url: https://grafana.riotpiao.com/
     - name: loki
       url: https://loki.riotpiao.com/ready
-    - name: authentik
-      url: https://authentik.riotpiao.com/-/health/ready/
+    - name: zitadel
+      url: https://zitadel.riotpiao.com/debug/ready
     - name: vault
       url: https://vault.riotpiao.com/v1/sys/health
     - name: minio-console