feat(iam): manage the Forgejo OAuth login source from a script

Forgejo keeps login sources in its database and exposes no REST endpoint for
them, so neither GitOps nor `tea` (whose admin command only manages users) can
set them. The in-pod CLI is the only supported writer.

This script wraps `gitea admin auth update-oauth` so the rename from the
Authentik-era label to `zitadel` is repeatable instead of a one-off command in
a shell history. Note in the header: the source name is both the button label
and the callback path, so ZITADEL must have both redirect URIs registered
before a rename.

scripts/iam/forgejo-oauth-source.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# forgejo-oauth-source.sh — keep the Forgejo OAuth login source aligned with
+# ZITADEL.
+#
+# Forgejo stores login sources in its database, not in GitOps, and its REST API
+# does not expose them. `tea` has no auth-source command either (tea admin only
+# manages users), so the supported writer is the in-pod CLI:
+#   gitea admin auth update-oauth
+#
+# The source name is the label on the "Sign in with ..." button AND the callback
+# path (/user/oauth2/<name>/callback), so a rename changes the registered
+# redirect URI. Register both spellings in ZITADEL (zitadel-provision.py does)
+# before renaming.
+#
+# Usage:
+#   scripts/iam/forgejo-oauth-source.sh status
+#   scripts/iam/forgejo-oauth-source.sh rename zitadel
+set -euo pipefail
+
+NS="${FORGEJO_NAMESPACE:-cicd}"
+SEL="${FORGEJO_SELECTOR:-app.kubernetes.io/name=forgejo}"
+
+pod() {
+  kubectl -n "$NS" get pods -l "$SEL" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null \
+    || kubectl -n "$NS" get pods -o name | grep -m1 forgejo-gitea | cut -d/ -f2
+}
+
+run() { kubectl -n "$NS" exec "$(pod)" -c gitea -- gitea admin auth "$@"; }
+
+case "${1:-status}" in
+  status) run list ;;
+  rename)
+    name="${2:?usage: $0 rename <name>}"
+    run update-oauth --id 1 --name "$name"
+    run list
+    ;;
+  *) echo "usage: $0 [status|rename <name>]" >&2; exit 2 ;;
+esac