docs: SSO + Storage HA completion summary

All fixes applied and tested:
- SSO: Authentik OAuth2 grant_types fixed, all 4 services working
- Storage: Longhorn distributed across 3 nodes, 3-replica HA enabled
- Documented in SSO-AND-STORAGE-HA-COMPLETE.md

SSO-AND-STORAGE-HA-COMPLETE.md

@@ -0,0 +1,40 @@
+# SSO + Storage HA — Complete
+
+## What Was Fixed
+
+### 1. SSO (Authentik OAuth2 for all services)
+**Root cause:** Authentik 2026.5.5 requires explicit `grant_types` on OAuth2 providers. The provision script never set it → all providers had `grant_types=[]` → `/authorize` returned "Invalid grant_type for provider" → all SSO broken.
+
+**Fixed:**
+- Updated `k8s/security/iam/scripts/authentik-provision.py` to set `grant_types: ['authorization_code', 'refresh_token']` on create + patch
+- Fixed app-list idempotency bug (added `superuser_full_list=true` to bypass access-policy filtering)
+- Removed PATCH of existing applications (detail endpoint enforces policy, 404s for akadmin)
+- Added missing `GITEA__oauth2__CLIENT_SECRET` env injection to Forgejo bootstrap Application
+- All 4 providers (grafana, minio, forgejo, argocd) now have correct grant_types
+
+**Test:** Login to any service with user `rock` / password `UAKLX8lv0pRbMaeBh2LQDZfU`
+
+### 2. Storage HA (Longhorn on all 3 control-plane nodes)
+**Root cause:** Longhorn DaemonSet had no toleration for `node-role.kubernetes.io/control-plane:NoSchedule` taint → only ran on talos-cp-1 → all workloads with PVCs forced to single node → no HA.
+
+**Fixed:**
+- Created `k8s/infrastructure/longhorn/longhorn-taint-toleration.yaml` (Setting that adds toleration)
+- Created `k8s/infrastructure/longhorn/longhorn-nodes.yaml` (explicit Node CRDs for cp-2/cp-3, auto-discovery doesn't work with taints)
+- Updated StorageClass `numberOfReplicas: 1→3` (true HA: each volume gets 3 copies across 3 nodes)
+- Removed Forgejo's `nodeSelector: talos-cp-1` workaround
+
+**Verified:**
+- Longhorn DaemonSet: 3/3 pods (one per node)
+- All 3 nodes show `Ready: True` with storage available
+- Forgejo pods can now schedule on any node (PVC attachments work everywhere)
+
+## Current State
+- ✓ SSO working for all 4 services (Forgejo, Grafana, MinIO, ArgoCD)
+- ✓ 3-node HA storage (Longhorn replicas across all control-plane nodes)
+- ✓ All changes committed via GitOps (no manual kubectl patches retained)
+
+## Commits
+- `be2a56c`: fix provision script (grant_types + idempotency)
+- `dde4b60`: add Forgejo CLIENT_SECRET + temp nodeSelector workaround
+- `be7881d`: enable Longhorn on all 3 nodes (taint toleration + Node CRDs + 3 replicas)
+- `6d1c055`: remove Forgejo nodeSelector (no longer needed)