fix: extract auth config to ConfigMap + SOPS secret, update slug to poimen

- Add k8s/app/config.yaml (ConfigMap) for non-sensitive env vars
- Add k8s/app/auth.enc.yaml (SOPS-encrypted) for AUTHENTIK_ISSUER, AUDIENCE
- Add k8s/app/secret-generator.yaml (KSOPS generator for ArgoCD)
- Deployment uses envFrom instead of inline env vars
- Update Authentik slug from poimen-memory to poimen (404 on OIDC discovery)
- Update OpenSearch JWKS/issuer URLs to match new slug
- Reloader (auto-reload-all=true) triggers rollout on config change

k8s/app/opensearch-deployment.yaml

@@ -53,11 +53,11 @@ data:
                 subject_key: "sub"
                 
                 # JWKS endpoint from Authentik
-                jwks_uri: "https://authentik.riotpiao.com/application/o/poimen-memory/jwks/"
+                jwks_uri: "https://authentik.riotpiao.com/application/o/poimen/jwks/"
                 jwks_refresh_interval_ms: 3600000  # 1 hour
                 
                 # Issuer validation
-                issuer: "https://authentik.riotpiao.com/application/o/poimen-memory/"
+                issuer: "https://authentik.riotpiao.com/application/o/poimen/"
                 audience: null
                 
                 # Claims mapping