feat(iam): define a KeyRotation for every consumer except poimen-memory

Eight objects cover grafana, argocd, comfyui, minio, paperless, immich, forgejo and
api-gw. Each names its ZITADEL app, the Secret it writes, the consumer to roll and
whether the consumer reloads hot or needs a restart.

All are suspended: the controller image does not exist yet, and an unsuspended
object would claim an intent that no process acts on.

The README records the retirement target for the 34 .enc.yaml files: six
root-of-trust secrets that cannot rotate themselves survive, everything else
becomes a KeyRotation and leaves git.

k8s/apps/key-rotation-controller/example-oidc-client.yaml

@@ -0,0 +1,27 @@
+# Example: rotate an OIDC app's client secret.
+#
+# ZITADEL keeps one secret per app, so the old value dies at the generate call.
+# The strategy is atomic: publish, roll the consumer, verify, and roll back if the
+# introspection check fails.
+apiVersion: iam.homelab.riotpiao.com/v1
+kind: KeyRotation
+metadata:
+  name: example-grafana-client
+  namespace: iam
+spec:
+  provider: zitadel-oidc-client
+  strategy: atomic
+  intervalHours: 2160       # 90 days
+  suspend: true
+  target:
+    zitadelProjectID: "396757796898471937"
+    zitadelAppID: "REPLACE_WITH_APP_ID"
+    secretName: grafana-oidc
+    secretNamespace: logging
+    secretKeys:
+      secret: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+    reload: restart         # Grafana reads the value at start
+    consumers:
+      - {kind: Deployment, name: grafana, namespace: logging}
+  verify:
+    introspect: true