k8s/storage: add minio s3 with 3-way replication and oidc

- MinIO 3-node site replication (az-a/b/c)
- S3 backend for Loki chunks (10-day retention)
- OIDC integration with Authentik
- envFrom for secret injection

k8s/storage/minio-legacy-alias.yaml

@@ -0,0 +1,14 @@
+# Backward-compatibility alias: anything still pointing at the old
+# minio.logging.svc.cluster.local address resolves to the universal
+# storage frontend. Apply AFTER `helm uninstall minio -n logging`
+# (the old release owns the Service name `minio` until then).
+apiVersion: v1
+kind: Service
+metadata:
+  name: minio
+  namespace: logging
+  labels:
+    app: minio
+spec:
+  type: ExternalName
+  externalName: minio.storage.svc.cluster.local