feat(cert-manager): add self-signed homelab-ca ClusterIssuer + trust bundle, fix grafana-oidc secret

homelab-ca was referenced by 6 manifests (authentik, forgejo-runner,
blackbox-exporter, management-service) as a CA trust ConfigMap but never
existed anywhere - not in git, not live in cluster. Generated a new
10-year self-signed root CA, wired it as a ClusterIssuer (cert-manager
namespace) and distributed the public cert as a ConfigMap to every
consuming namespace (iam, cicd, monitoring, sqs). Private key lives only
in the encrypted Secret. Widened cert-manager-issuers' directory include
glob rather than creating a new Application - destination.namespace is
just a fallback default on a plain directory source, not a transformer,
so it doesn't fight with each ConfigMap's own explicit namespace.

Also adds grafana-oidc secret (GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET),
same pre-existing gap as grafana-admin - was meant to come from a deleted
manual script, value already available in .env.

k8s/bootstrap/cert-manager/homelab-ca-issuer.yaml

@@ -0,0 +1,13 @@
+# k8s/bootstrap/cert-manager/homelab-ca-issuer.yaml
+# Self-signed internal CA, for services that only need to trust each other
+# on the homelab LAN (not exposed to the internet, no public ACME needed).
+# Root cert+key live in homelab-ca-secrets.enc.yaml (cert-manager namespace).
+# The public cert is separately distributed via homelab-ca-configmap.yaml so
+# non-cert-manager pods (Authentik, forgejo-runner, etc.) can trust it too.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: homelab-ca
+spec:
+  ca:
+    secretName: homelab-ca-keypair