fix(coredns): own Corefile+hostname rewrites via Talos inlineManifest (single-source terraform/files/coredns/Corefile), drop ArgoCD coredns-config app — in-cluster *.riotpiao.com now resolves to nginx ingress so MinIO/OIDC discovery works; update cp-2 IP .213->.214

terraform/templates/controlplane.tftpl

@@ -164,3 +164,18 @@ cluster:
         kind: Namespace
         metadata:
           name: kube-system
+    # CoreDNS Corefile with homelab hostname rewrites (single source of truth in
+    # terraform/files/coredns/Corefile). In-cluster pods resolve *.riotpiao.com to
+    # the nginx ingress controller so OIDC auto-discovery against
+    # authentik.riotpiao.com works and the Host header is preserved. Owned by
+    # Talos — do NOT also manage the coredns ConfigMap via ArgoCD.
+    - name: coredns-config
+      contents: |
+        apiVersion: v1
+        kind: ConfigMap
+        metadata:
+          name: coredns
+          namespace: kube-system
+        data:
+          Corefile: |
+            ${indent(12, coredns_corefile)}