feat(sso): complete MinIO OIDC env + add Homarr landing page base config

MinIO (Part B):
- k8s/infrastructure/minio/minio-tenant.yaml: added full OIDC env block
  (CONFIG_URL, CLIENT_ID, CLIENT_SECRET from minio-oidc secret, CLAIM_NAME,
  REDIRECT_URI, DISPLAY_NAME, SCOPES) — MinIO console SSO login will now work

Homarr (Part C1 - base):
- k8s/applications/homarr/homarr-values.yaml: official chart config with
  Authentik SSO (AUTH_PROVIDERS=oidc, all OIDC env vars, client creds from
  homarr-oidc secret, SECRET_ENCRYPTION_KEY from SOPS secret)
- k8s/applications/homarr/homarr-secrets.enc.yaml: age-encrypted
  SECRET_ENCRYPTION_KEY (stable key — rotating it breaks saved integrations)
- k8s/applications/homarr/kustomization.yaml: namespace dashboard

Still TODO for Homarr:
- Add 'homarr' to authentik-provision.py SERVICES dict
- Add Application to 60-applications.yaml (multi-source: chart + values)
- Add ingress rule (k8s/bootstrap/ingress/ingress.yaml)
- Add CoreDNS rewrite (k8s/bootstrap/coredns/coredns-configmap.yaml)
- Add dashboard RoleBinding for authentik-provisioner SA

k8s/applications/homarr/homarr-values.yaml

@@ -0,0 +1,67 @@
+# Homarr landing page — official chart from homarr-labs/charts.
+# SSO via Authentik, single-replica (UI state lives on PVC, not git).
+image:
+  repository: ghcr.io/homarr-labs/homarr
+  tag: "1.0.0"  # Pin to stable
+  pullPolicy: IfNotPresent
+
+replicaCount: 1
+
+service:
+  type: ClusterIP
+  port: 3000
+
+persistence:
+  enabled: true
+  storageClass: longhorn-wffc
+  accessMode: ReadWriteOnce
+  size: 5Gi
+
+env:
+  - name: AUTH_PROVIDERS
+    value: "oidc,credentials"
+  - name: AUTH_OIDC_ISSUER
+    value: "https://authentik.riotpiao.com/application/o/homarr/"
+  - name: AUTH_OIDC_CALLBACK_URL
+    value: "https://homarr.riotpiao.com/api/auth/callback/oidc"
+  - name: AUTH_OIDC_CLIENT_NAME
+    value: "Authentik"
+  - name: AUTH_OIDC_GROUPS_ATTRIBUTE
+    value: "groups"
+  - name: AUTH_OIDC_CLIENT_ID
+    valueFrom:
+      secretKeyRef:
+        name: homarr-oidc
+        key: client-id
+  - name: AUTH_OIDC_CLIENT_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: homarr-oidc
+        key: client-secret
+  - name: SECRET_ENCRYPTION_KEY
+    valueFrom:
+      secretKeyRef:
+        name: homarr-secrets
+        key: SECRET_ENCRYPTION_KEY
+  - name: OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING
+    value: "true"
+  - name: BASE_URL
+    value: "https://homarr.riotpiao.com"
+  - name: NEXTAUTH_URL
+    value: "https://homarr.riotpiao.com"
+
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
+
+ingress:
+  enabled: false  # Managed centrally in k8s/bootstrap/ingress/ingress.yaml