feat(iam): automate Authentik OAuth provisioning + create admin user rock

k8s/security/ci-cd/forgejo-values.yaml

@@ -52,6 +52,12 @@ gitea:
       OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
       CLIENT_ID: forgejo
       AUTO_DISCOVER_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
+      # CLIENT_SECRET was missing entirely before - oauth2 login could never
+      # have worked. Value comes from the forgejo-oidc Secret (created by the
+      # authentik-provision PostSync hook, see k8s/security/iam/authentik-
+      # provision-job.yaml) via extraEnv below, since this oauth2: map is
+      # rendered directly into plain env vars and can't reference a Secret
+      # inline the way envFromSecret/extraEnv can.
     cache:
       ADAPTER: redis
       HOST: redis://forgejo-redis.cicd.svc:6379/0
@@ -139,6 +145,17 @@ tolerations:
 # trusting both the standard Mozilla bundle and our homelab CA.
 # Required for OIDC: Forgejo fetches Authentik's discovery endpoint which
 # presents a cert signed by homelab-ca.
+# CLIENT_SECRET for the oauth2 block above - gitea's own config map (oauth2:)
+# can only hold plain values, so the Secret-backed one is injected as
+# GITEA__oauth2__CLIENT_SECRET, following the chart's standard
+# GITEA__<section>__<KEY> env-var-to-ini-config convention.
+extraEnv:
+  - name: GITEA__oauth2__CLIENT_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: forgejo-oidc
+        key: CLIENT_SECRET
+
 extraVolumes:
   - name: homelab-ca
     configMap: