k8s/storage: add minio s3 with 3-way replication and oidc

- MinIO 3-node site replication (az-a/b/c)
- S3 backend for Loki chunks (10-day retention)
- OIDC integration with Authentik
- envFrom for secret injection

k8s/storage/longhorn-ingress-oauth2.yaml

@@ -0,0 +1,25 @@
+# Ingress for Longhorn storage UI — routes to OAuth2-Proxy
+# TLS terminated here; oauth2-proxy handles OIDC auth
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  ingressClassName: nginx
+  tls:
+  - secretName: longhorn-tls
+    hosts:
+    - longhorn.riotpiao.homelab.com
+  rules:
+  - host: longhorn.riotpiao.homelab.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: oauth2-proxy
+            port:
+              number: 4180