feat(iam): wire all 9 consumer manifests to Zitadel OIDC

Co-authored-by: rock <[email protected]>

k8s/infra/logging/grafana-values.yaml

@@ -60,28 +60,28 @@ grafana.ini:
   database:
     wal: true
 
-  # ── Authentik OIDC (generic OAuth2) ───────────────────────────────────────
+  # ── ZITADEL OIDC (generic OAuth2) ────────────────────────────────────────
   # Grafana v10+ supports OIDC auto-discovery; we wire it manually here because
-  # Authentik's discovery endpoint is internal-only (no external DNS for iam.svc).
+  # ZITADEL's discovery endpoint is internal-only (no external DNS for iam.svc).
   # All URLs use the external hostname so CoreDNS rewrites them to
-  # authentik-server.iam.svc — this keeps the Host header correct so Authentik
+  # zitadel.iam.svc — this keeps the Host header correct so ZITADEL
   # doesn't return localhost redirects in its token responses.
   #
   # role_attribute_path: JMESPath expression evaluated against the userinfo
   # response. akadmin gets GrafanaAdmin (server admin, can impersonate);
-  # homelab-admins members get Admin (org admin); everyone else Viewer.
+  # homelab-admins role members get Admin (org admin); everyone else Viewer.
   auth.generic_oauth:
     enabled: true
-    name: Authentik
+    name: Zitadel
     allow_sign_up: true  # Allow sync to create/update users from OAuth claims
-    client_id: grafana
+    client_id: 396757801965191169
     scopes: openid email profile groups
-    auth_url: https://authentik.riotpiao.com/application/o/authorize/
-    token_url: https://authentik.riotpiao.com/application/o/token/
-    api_url: https://authentik.riotpiao.com/application/o/userinfo/
+    auth_url: https://zitadel.riotpiao.com/oauth/v2/authorize
+    token_url: https://zitadel.riotpiao.com/oauth/v2/token
+    api_url: https://zitadel.riotpiao.com/oidc/v1/userinfo
     # Read identity straight from the userinfo/id_token claims. Without these,
     # Grafana falls back to the GitHub-style "<api_url>/emails" call, which
-    # Authentik doesn't serve — request 404s with "Error getting email address"
+    # ZITADEL doesn't serve — request 404s with "Error getting email address"
     # and the whole OAuth login fails.
     email_attribute_path: email
     login_attribute_path: preferred_username  # Use preferred_username — OpenID standard claim, always present
@@ -91,10 +91,10 @@ grafana.ini:
     use_pkce: false
     use_refresh_token: false
     skip_org_role_sync: false  # Sync org roles from OAuth groups
-    tls_skip_verify_insecure: true   # Authentik uses self-signed cert; verify in prod
+    tls_skip_verify_insecure: true   # In-cluster cert; verify in prod
 
 # GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET is injected from the grafana-oidc K8s
-# Secret (created by k8s/talos-iam/setup_talos_iam.sh). envFromSecret mounts
+# Secret (k8s/argocd/secrets/grafana-oidc-secrets.enc.yaml). envFromSecret mounts
 # every key in that secret as an environment variable — keeps secrets out of
 # values files and out of git.
 envFromSecret: grafana-oidc