feat(cert-manager): add self-signed homelab-ca ClusterIssuer + trust bundle, fix grafana-oidc secret

homelab-ca was referenced by 6 manifests (authentik, forgejo-runner,
blackbox-exporter, management-service) as a CA trust ConfigMap but never
existed anywhere - not in git, not live in cluster. Generated a new
10-year self-signed root CA, wired it as a ClusterIssuer (cert-manager
namespace) and distributed the public cert as a ConfigMap to every
consuming namespace (iam, cicd, monitoring, sqs). Private key lives only
in the encrypted Secret. Widened cert-manager-issuers' directory include
glob rather than creating a new Application - destination.namespace is
just a fallback default on a plain directory source, not a transformer,
so it doesn't fight with each ConfigMap's own explicit namespace.

Also adds grafana-oidc secret (GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET),
same pre-existing gap as grafana-admin - was meant to come from a deleted
manual script, value already available in .env.

k8s/infra/logging/grafana-oidc-secrets.enc.yaml

@@ -0,0 +1,23 @@
+apiVersion: ENC[AES256_GCM,data:oE0=,iv:w1yJeQvN0MPZlPx8VQZmC6zkRaHW4rtjjROea0Kx9X4=,tag:Q6/g6shLyarH7fq3213uWA==,type:str]
+kind: ENC[AES256_GCM,data:x2QYj605,iv:C8c/jKh5pnBOtHqXsTEchGf9DACU/5hOJ0Mp/+Jk1kg=,tag:2tE/oKg6ma0F9/hzXSoZ+w==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:BBXxuz8iuqdpE3W3,iv:bWEqo28kH3bxzfI3ipiY6dsqhIcl9wIxBjFu0mxVGLg=,tag:aKN13YwwVYl0813BaNW2Ng==,type:str]
+    namespace: ENC[AES256_GCM,data:0msz8sHCrQ==,iv:3evUnFTQfRz/ZilUQIl/9dsCba3nsX6o/iQsGXMBfgM=,tag:d8owVKUbOOmo/TJ8X00WdA==,type:str]
+type: ENC[AES256_GCM,data:SS8WJgF3,iv:8qqNddsuw4YoHAuJfUcPIqjcqNySIh5Ln8OhsfZxuk8=,tag:x+cc6pIRCZNxbZRWyTvzUQ==,type:str]
+stringData:
+    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:+jGjNWkjUZKd3vzTwkbSurCfXix3xSX567Kfq+M1mp4JoBEvWB2FAcaaYgs8NxYuQHia0v3oV+lRyoo96IOCSw==,iv:NCeW/UfIl0RvHV39ubN2mDfFp7GTQNuFv8KiEF+7KOE=,tag:WiHvx83dlIR/xTfgDS7NoA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqOE5iODMzdUlGMzY5TS8x
+            UUhIUDJYenIxTTNNTC96WjB2NDl1cDl6QlhrCmxrMGlEa25EQkY3WDRGMUs5S0pq
+            NVVacUQyV3hYNHF4WGZ6a1dFbi9xbzgKLS0tIHBYVFpQRnZwTUJQYTdjWjNkVW1W
+            Nm81dWZpMFBYL003Y2NSOTJOWmozMjQKntzx0PHgydDFUDdUe5EMxmaGIL8rpUh4
+            +3q8rxu6wdQQ6RmgiySbpS2Cfs17z2t6zkqdVbvuyqlSkjMrMk1+bw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
+    lastmodified: "2026-08-11T23:33:41Z"
+    mac: ENC[AES256_GCM,data:0bbUl3wQjuGOoKA1c13lNYRcyQI8iUlrHibN2rJReYMqzQ37hHquxZNS3GJC4xQiXwaqNgNQeOO3BRW7qzjQWb5QxB2axVdvEaWjJzS6cxzr8/ONPELZRHFBgNkWIMi4f3fi8BTJKE2p6rsepHH6JL5JYVl8DO/j68mKUObjAe8=,iv:ojFWfOMJ8cVcKLsJBl1HjCk6sJucxsEZMxl5f59tf78=,tag:zqBso7DGAkvoJuE0PZMq0Q==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2