fix(iam): use the built-in ZITADEL login page

Sign-in failed with "Could not create session for user". The ZITADEL API
logged, on every session call:

  authz: verify access token -> invalid token
  token verifier repo: issuer does not match: Expected
    https://zitadel.riotpiao.com, got: login-client
  zitadel-login: [Password] Could not update session

The hosted Login UI authenticates as the machine user `login-client`. That
user did not exist in this instance, because the chart's setup job creates it
and setupJob is disabled after the first sync. Without the user the UI cannot
write a session, so no one can sign in, at ZITADEL or at Forgejo.

Disable the hosted Login UI so ZITADEL serves its built-in login, which needs
no machine user. Re-enable only after creating `login-client` and registering
the public key that matches zitadel-login-service-key.

Also register both callback spellings for the forgejo and paperless apps: the
callback path follows the login-source name, so a rename between authentik and
zitadel must not break sign-in.

scripts/iam/zitadel-provision.py

@@ -96,7 +96,12 @@ OIDC_APPS = {
     "argocd": {**_WEB, "redirect_uris": [
         "http://localhost:8080/auth/callback",
         "https://argocd.riotpiao.com/auth/callback"]},
+    # Forgejo derives the callback path from the login-source NAME
+    # (/user/oauth2/<name>/callback). Both spellings are registered so a
+    # rename between authentik and zitadel never breaks sign-in.
     "forgejo": {**_WEB, "redirect_uris": [
+        "http://localhost:3000/user/oauth2/zitadel/callback",
+        "https://forgejo.riotpiao.com/user/oauth2/zitadel/callback",
         "http://localhost:3000/user/oauth2/authentik/callback",
         "https://forgejo.riotpiao.com/user/oauth2/authentik/callback"]},
     "grafana": {**_WEB, "redirect_uris": [
@@ -111,6 +116,8 @@ OIDC_APPS = {
         "http://localhost:9000/auth/sso/oauth2/code",
         "https://minio.riotpiao.com/auth/sso/oauth2/code"]},
     "paperless": {**_WEB, "redirect_uris": [
+        "http://localhost:8000/accounts/oidc/zitadel/login/callback/",
+        "https://paperless.riotpiao.com/accounts/oidc/zitadel/login/callback/",
         "http://localhost:8000/accounts/oidc/authentik/login/callback/",
         "https://paperless.riotpiao.com/accounts/oidc/authentik/login/callback/"]},
     "poimen": {**_WEB, "redirect_uris": [