feat(iam): wire all 9 consumer manifests to Zitadel OIDC

scripts/iam/provision-rbac.py

@@ -351,11 +351,6 @@ OAuth2_PROVIDERS = {
         "client_secret": "QxyWfESXqTD55aUyh6miYnny1QTCEuEwyC4escw9",
         "redirect_uris": ["app.immich:///oauth-callback", "https://img.riotpiao.com/auth/login", "https://img.riotpiao.com/user/oauth2/callback"],
     },
-    "homarr": {
-        "client_id": "homarr",
-        "client_secret": "RMlDQAWdjT5YPPH0U7ztDoUFP7R7w95b2xqQ1pyS",
-        "redirect_uris": ["http://localhost:7575/auth/callback", "https://homarr.riotpiao.com/auth/callback"],
-    },
     "argocd": {
         "client_id": "argocd",
         "client_secret_env": "AUTHENTIK_PROVIDER_ARGOCD_SECRET",

scripts/iam/rotate-secrets.sh

@@ -53,7 +53,7 @@ generate_secret() {
 
 declare -A NEW_SECRETS
 
-for svc in api-gw minio poimen paperless grafana argocd forgejo homarr immich vault portfolio-agent memory-agent local-llm; do
+for svc in api-gw minio poimen paperless grafana argocd forgejo immich vault portfolio-agent memory-agent local-llm; do
   NEW_SECRETS[$svc]=$(generate_secret)
   log "  $svc: ${NEW_SECRETS[$svc]:0:15}..."
 done
@@ -70,7 +70,6 @@ declare -A PROVIDER_PKS=(
   [grafana]=6
   [argocd]=7
   [forgejo]=8
-  [homarr]=9
   [immich]=10
   [vault]=11
 )
@@ -203,7 +202,7 @@ fi
 log ""
 log "=== Summary ==="
 log "Rotated 13 credentials:"
-log "  OAuth2 Providers: api-gw, minio, poimen, paperless, grafana, argocd, forgejo, homarr, immich, vault"
+log "  OAuth2 Providers: api-gw, minio, poimen, paperless, grafana, argocd, forgejo, immich, vault"
 log "  Service Accounts: portfolio-agent, memory-agent, local-llm"
 
 log ""

scripts/iam/zitadel-provision.py

@@ -98,9 +98,6 @@ OIDC_APPS = {
     "grafana": {**_WEB, "redirect_uris": [
         "http://localhost:3000/login/generic_oauth",
         "https://grafana.riotpiao.com/login/generic_oauth"]},
-    "homarr": {**_WEB, "redirect_uris": [
-        "http://localhost:7575/auth/callback",
-        "https://homarr.riotpiao.com/auth/callback"]},
     "immich": {**_WEB, "app_type_id": "OIDC_APP_TYPE_NATIVE", "redirect_uris": [
         "app.immich:///oauth-callback", "https://img.riotpiao.com/auth/login",
         "https://img.riotpiao.com/user/oauth2/callback"]},
@@ -362,10 +359,6 @@ def phase_apply(_args: argparse.Namespace) -> int:
 SECRET_MAP = {
     "grafana": [("grafana-oidc-secrets.enc.yaml", "grafana-oidc",
                  "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET", "secret")],
-    "homarr": [("homarr-auth-oidc.enc.yaml", "homarr-oidc",
-                "client-id", "id"),
-               ("homarr-auth-oidc.enc.yaml", "homarr-oidc",
-                "client-secret", "secret")],
     "minio": [("minio-secrets.enc.yaml", "minio-oidc",
                "MINIO_IDENTITY_OPENID_CLIENT_SECRET", "secret")],
     "paperless": [("paperless-ai-secrets.enc.yaml", "paperless-ai-config",