feat(cert-manager): add self-signed homelab-ca ClusterIssuer + trust bundle, fix grafana-oidc secret

homelab-ca was referenced by 6 manifests (authentik, forgejo-runner,
blackbox-exporter, management-service) as a CA trust ConfigMap but never
existed anywhere - not in git, not live in cluster. Generated a new
10-year self-signed root CA, wired it as a ClusterIssuer (cert-manager
namespace) and distributed the public cert as a ConfigMap to every
consuming namespace (iam, cicd, monitoring, sqs). Private key lives only
in the encrypted Secret. Widened cert-manager-issuers' directory include
glob rather than creating a new Application - destination.namespace is
just a fallback default on a plain directory source, not a transformer,
so it doesn't fight with each ConfigMap's own explicit namespace.

Also adds grafana-oidc secret (GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET),
same pre-existing gap as grafana-admin - was meant to come from a deleted
manual script, value already available in .env.

k8s/argocd/apps/00-substrate.yaml

@@ -90,7 +90,7 @@ spec:
     targetRevision: main
     path: k8s/bootstrap/cert-manager
     directory:
-      include: "letsencrypt-issuer.yaml"
+      include: "{letsencrypt-issuer.yaml,homelab-ca-issuer.yaml,homelab-ca-configmap.yaml}"
   destination:
     server: https://kubernetes.default.svc
     namespace: cert-manager