feat(argocd): wire SOPS CMP sidecar + fix loki/grafana/authentik secret resolution

k8s/security/iam/authentik-values.yaml

@@ -92,6 +92,10 @@ _caInitContainers: &caInitContainers
     envFrom:
       - secretRef:
           name: authentik
+      # SOPS-CMP-emitted secret values (SECRET_KEY, PG password, bootstrap creds)
+      # merged after the chart config secret — see sops-cmp-plugin.yaml.
+      - secretRef:
+          name: authentik-secrets
     volumeMounts: *caVolumeMounts
 
 _caEnv: &caEnv
@@ -107,6 +111,10 @@ _caEnv: &caEnv
 # Recreate: single replica + RWO-adjacent state — avoids split-brain on redeploy.
 server:
   replicas: 1
+  # Merge SOPS-CMP-emitted secret values after the chart's own `authentik` secret.
+  envFrom:
+    - secretRef:
+        name: authentik-secrets
   deploymentStrategy:
     type: Recreate
   service:
@@ -145,6 +153,9 @@ server:
 # into the server process but the worker pod is still required.
 worker:
   replicas: 1
+  envFrom:
+    - secretRef:
+        name: authentik-secrets
   deploymentStrategy:
     type: Recreate
   resources: