fix(iam): give the IAM support manifests an ArgoCD app again

Retiring Authentik deleted the iam-jobs Application, so k8s/infra/iam stopped
being synced. The new smtp-gotify relay would have sat in git and never been
created.

Add an iam-support Application for that path, and drop the stale
rbac-dashboard-rolebinding reference from its kustomization: the file went away
with Authentik, and a missing resource fails the whole app.

k8s/infra/iam/kustomization.yaml

@@ -2,7 +2,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - rbac-dashboard-rolebinding.yaml
+  # Removed: rbac-dashboard-rolebinding.yaml (authentik-provisioner SA and
+  # RoleBinding). Authentik is retired, so the file is gone; keep this list in
+  # step with the directory or kustomize fails the whole app.
   - smtp-gotify.yaml
 
 # IAM provisioning is manual-only (security-sensitive).