feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/security/iam/authentik-values.yaml

@@ -17,7 +17,7 @@ authentik:
   # Must match what the browser sees — if it returns an internal svc URL,
   # the browser's redirect after login will fail (can't reach svc DNS externally).
   # HTTP (not HTTPS) because the Authentik ingress has no TLS cert configured.
-  host: "https://authentik.riotpiao.homelab.com"
+  host: "https://authentik.riotpiao.com"
 
   error_reporting:
     enabled: false   # do not phone home to Sentry
@@ -103,7 +103,7 @@ _caEnv: &caEnv
 # ── Authentik server (UI + API) ───────────────────────────────────────────────
 # Handles all browser traffic: login flows, admin UI, OAuth2 authorize/token endpoints.
 # NodePort 32172 is a fallback for direct node access during troubleshooting;
-# normal access is via nginx ingress (authentik.riotpiao.homelab.com → svc:80).
+# normal access is via nginx ingress (authentik.riotpiao.com → svc:80).
 # Recreate: single replica + RWO-adjacent state — avoids split-brain on redeploy.
 server:
   replicas: 1
@@ -221,5 +221,5 @@ redis:
                   operator: Exists
   architecture: standalone
 
-# Ingress disabled — rule lives in k8s/ingress/ingress.yaml (authentik.riotpiao.homelab.com).
+# Ingress disabled — rule lives in k8s/ingress/ingress.yaml (authentik.riotpiao.com).
 # For direct access during bootstrap: kubectl -n iam port-forward svc/authentik-server 7000:80