feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/applications/temporal/TEMPORAL_OAUTH2_SETUP.md

@@ -19,7 +19,7 @@ Browser → Ingress (TLS) → oauth2-proxy (OIDC check) → temporal-web (intern
 ✅ Authentik OIDC provider `temporal` already exists with:
 - Client ID: `temporal`
 - Client Secret: stored in Kubernetes secret `temporal-oidc` (key: `clientSecret`)
-- Redirect URI: `https://temporal.riotpiao.homelab.com/oauth2/callback`
+- Redirect URI: `https://temporal.riotpiao.com/oauth2/callback`
 
 ## Secrets
 
@@ -85,14 +85,14 @@ kubectl get ingress -n temporal
 Expected:
 ```
 NAME      CLASS   HOSTS                              ADDRESS   PORTS     AGE
-temporal  nginx   temporal.riotpiao.homelab.com      ...       80, 443   10s
+temporal  nginx   temporal.riotpiao.com      ...       80, 443   10s
 ```
 
 ### Step 3: Test Access
 
 1. **Open Temporal UI (unauthenticated):**
    ```bash
-   open https://temporal.riotpiao.homelab.com
+   open https://temporal.riotpiao.com
    ```
    
    Expected: Redirects to Authentik login page
@@ -100,12 +100,12 @@ temporal  nginx   temporal.riotpiao.homelab.com      ...       80, 443   10s
 2. **Login with Authentik credentials**
    - Username/email
    - Password
-   - Should redirect back to `temporal.riotpiao.homelab.com` and display UI
+   - Should redirect back to `temporal.riotpiao.com` and display UI
 
 3. **Verify auth:**
    ```bash
    # Check for oauth2_proxy cookie
-   curl -v https://temporal.riotpiao.homelab.com 2>&1 | grep -i cookie
+   curl -v https://temporal.riotpiao.com 2>&1 | grep -i cookie
    ```
 
 4. **Check oauth2-proxy logs:**
@@ -127,7 +127,7 @@ redirect_uri_mismatch: The redirect_uri does not match the one registered in Aut
 ```
 
 Fix:
-- Verify Authentik application (Applications → temporal) has redirect URI: `https://temporal.riotpiao.homelab.com/oauth2/callback`
+- Verify Authentik application (Applications → temporal) has redirect URI: `https://temporal.riotpiao.com/oauth2/callback`
 - Ensure HTTPS (not HTTP)
 
 ### Missing secret