fix(iam): merge into the consumer Secret, and retry with a backoff

Two defects that a real rotation exposed:

  merge      writeSecret replaced the whole Secret map, so every key a consumer
             keeps beside the credential disappeared. paperless lost
             SOCIALACCOUNT_PROVIDERS_JSON and immich lost config.json; both pods then
             failed to start while the rotation reported success.
  backoff    a Failed attempt returned 0, so the controller retried in a tight loop.
             It now waits two minutes and then retries.

All eight objects carry both identifiers ZITADEL needs: the app resource id for the
secret endpoint and the client id for introspection.

Result: seven rotations reach Succeeded with every consumer ready (grafana, comfyui,
argocd, forgejo, paperless, immich, minio). api-gw stays suspended because no workload
exists for it.

k8s/apps/key-rotation-controller/rotations.yaml

@@ -25,6 +25,7 @@ spec:
   target:
     zitadelProjectID: "396757796898471937"
     zitadelAppID: "396757801948413953"  # app resource id, not the client id 396757801965191169
+    zitadelClientID: "396757801965191169"
     secretName: grafana-oidc
     secretNamespace: logging
     secretKeys:
@@ -50,6 +51,7 @@ spec:
   target:
     zitadelProjectID: "396757796898471937"
     zitadelAppID: "396757801210216831"  # app resource id, not the client id 396757801210282367
+    zitadelClientID: "396757801210282367"
     secretName: argocd-oidc
     secretNamespace: argocd
     secretKeys:
@@ -75,6 +77,7 @@ spec:
   target:
     zitadelProjectID: "396757796898471937"
     zitadelAppID: "397015743994003854"  # app resource id, not the client id 397015744010781070
+    zitadelClientID: "397015744010781070"
     secretName: comfyui-oauth2-proxy
     secretNamespace: comfyui
     secretKeys:
@@ -100,13 +103,14 @@ spec:
   target:
     zitadelProjectID: "396757796898471937"
     zitadelAppID: "396757803240259585"  # app resource id, not the client id 396757803257036801
+    zitadelClientID: "396757803257036801"
     secretName: minio-oidc
-    secretNamespace: minio
+    secretNamespace: storage
     secretKeys:
       secret: client-secret
     reload: hot
     consumers:
-      - {kind: Deployment, name: minio, namespace: minio}
+      - {kind: StatefulSet, name: minio-cluster-az-a, namespace: storage}
   verify:
     introspect: true
 ---
@@ -125,6 +129,7 @@ spec:
   target:
     zitadelProjectID: "396757796898471937"
     zitadelAppID: "396757803542249855"  # app resource id, not the client id 396757803559027071
+    zitadelClientID: "396757803559027071"
     secretName: paperless-oidc
     secretNamespace: paperless
     secretKeys:
@@ -150,6 +155,7 @@ spec:
   target:
     zitadelProjectID: "396757796898471937"
     zitadelAppID: "396757802602725759"  # app resource id, not the client id 396757802602791295
+    zitadelClientID: "396757802602791295"
     secretName: immich-oidc
     secretNamespace: immich
     secretKeys:
@@ -175,13 +181,14 @@ spec:
   target:
     zitadelProjectID: "396757796898471937"
     zitadelAppID: "396757801562538367"  # app resource id, not the client id 396757801579315583
+    zitadelClientID: "396757801579315583"
     secretName: forgejo-oidc
-    secretNamespace: forgejo
+    secretNamespace: cicd
     secretKeys:
-      secret: key
+      secret: CLIENT_SECRET
     reload: restart
     consumers:
-      - {kind: StatefulSet, name: forgejo, namespace: forgejo}
+      - {kind: Deployment, name: forgejo-gitea, namespace: cicd}
   verify:
     introspect: true
 ---
@@ -200,6 +207,7 @@ spec:
   target:
     zitadelProjectID: "396757796898471937"
     zitadelAppID: "396757800857895295"  # app resource id, not the client id 396757800874672511
+    zitadelClientID: "396757800874672511"
     secretName: api-gw-oidc
     secretNamespace: api-gw
     secretKeys: