feat(iam): wire all 9 consumer manifests to Zitadel OIDC

Co-authored-by: rock <[email protected]>

k8s/bootstrap/phase4-argocd/argocd-values.yaml

@@ -138,12 +138,12 @@ configs:
     #   cicd  — automation-only; apiKey (token) for the CD pipeline, no UI login.
     accounts.rock: apiKey,login
     accounts.cicd: apiKey
-    # Authentik OIDC. clientSecret pulled from the argocd `oidc-secret` Secret
-    # (created by authentik-provision). The groups claim drives RBAC below.
+    # Zitadel OIDC. clientSecret pulled from the argocd `oidc-secret` Secret.
+    # The groups claim drives RBAC below.
     oidc.config: |
-      name: Authentik
-      issuer: https://authentik.riotpiao.com/application/o/argocd/
-      clientID: argocd
+      name: Zitadel
+      issuer: https://zitadel.riotpiao.com
+      clientID: 396757801210282367
       clientSecret: $oidc-secret:client-secret
       requestedScopes:
         - openid
@@ -158,7 +158,7 @@ configs:
     server.insecure: false
 
   # RBAC. local `admin` + `rock` + the `cicd` pipeline account all get role:admin;
-  # the Authentik `homelab-admins` group (rock is a member) maps to admin so SSO
+  # the Zitadel `homelab-admins` role (rock is a member) maps to admin so SSO
   # logins are admin too.
   rbac:
     policy.default: role:readonly