k8s/storage: add minio s3 with 3-way replication and oidc

- MinIO 3-node site replication (az-a/b/c)
- S3 backend for Loki chunks (10-day retention)
- OIDC integration with Authentik
- envFrom for secret injection

k8s/storage/.env.example

@@ -0,0 +1,9 @@
+# storage/.env.example
+# Copy to storage/.env and fill in real values.
+# The real .env is gitignored — never commit it.
+# Used by: k8s/storage/bootstrap.sh
+
+# MinIO root credentials (S3-compatible object store)
+#   openssl rand -base64 24
+MINIO_ROOT_USER=
+MINIO_ROOT_PASSWORD=