fix(sso): complete forgejo OAuth2 integration + force pods to storage node

Adds missing CLIENT_SECRET env injection + nodeSelector constraint:
- k8s/argocd/bootstrap/forgejo.yaml: inject GITEA__oauth2__CLIENT_SECRET
  from forgejo-oidc Secret (created by authentik-provision Job), and pin
  pods to talos-cp-1 via nodeSelector (only node with Longhorn storage —
  gitea-shared-storage PVC can't attach on cp-2/cp-3)

Root cause chain for 'Forgejo SSO not working':
1. Authentik 2026.5.5 requires explicit grant_types on OAuth2 providers
2. Old provision script never set it → all providers had grant_types=[]
3. /authorize returned 'Invalid grant_type for provider' → all SSO broken
4. Fixed in k8s/security/iam/scripts/authentik-provision.py (commit be2a56c)
   + successfully re-ran via iam-jobs Application sync
5. But Forgejo deployment still missing CLIENT_SECRET env var → no creds
6. Forgejo bootstrap App used inline valuesObject (chicken-egg with git
   repo self-hosting), but missing the extraEnv block that was only in
   k8s/security/ci-cd/forgejo-values.yaml → CLIENT_SECRET never injected

All 4 OAuth2 providers now have correct grant_types=['authorization_code',
'refresh_token'], Forgejo pods now have CLIENT_SECRET env, and pods are
constrained to the storage node. SSO login flow should now work end-to-end.

k8s/argocd/bootstrap/forgejo.yaml

@@ -88,6 +88,11 @@ spec:
                 secretKeyRef:
                   name: ddb-cluster-app
                   key: password
+            - name: GITEA__oauth2__CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: forgejo-oidc
+                  key: CLIENT_SECRET
         podAnnotations:
           configmap.reloader.stakater.com/reload: "homelab-ca"
         service:
@@ -112,6 +117,8 @@ spec:
           limits:
             cpu: "1"
             memory: 1Gi
+        nodeSelector:
+          kubernetes.io/hostname: talos-cp-1
         tolerations:
           - key: node-role.kubernetes.io/control-plane
             operator: Exists