fix: remove spec wrapper from ClusterRoleBinding

- ClusterRoleBinding doesn't use spec: wrapper (unlike Deployment/StatefulSet)
- roleRef and subjects go at top level with metadata
- Fixes: 'strict decoding error: unknown field "spec"'

k8s/infra/rbac/admin-oidc-binding.yaml

@@ -2,15 +2,14 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: homelab-admin-oidc
-spec:
-  roleRef:
-    apiGroup: rbac.authorization.k8s.io
-    kind: ClusterRole
-    name: cluster-admin
-  subjects:
-    # OIDC group for Authentik homelab-admins members
-    # When rock logs in via OIDC, k8s sees:
-    # - User: oidc:[email protected]
-    # - Groups: oidc:homelab-admins (from Authentik group claim)
-    - kind: Group
-      name: oidc:homelab-admins
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  # OIDC group for Authentik homelab-admins members
+  # When rock logs in via OIDC, k8s sees:
+  # - User: oidc:[email protected]
+  # - Groups: oidc:homelab-admins (from Authentik group claim)
+  - kind: Group
+    name: oidc:homelab-admins