feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

Fixes controlplane.tftpl's install.wipe:true (should be false, live CPs already run false) and syncs coredns Corefile back to what's actually deployed (drops an unrolled-out, stale Kong-era rewrite).

k8s/argocd/apps/60-applications.yaml

@@ -141,6 +141,35 @@ spec:
       prune: true
       selfHeal: true
 ---
+# Document management. Raw manifests (no Helm): postgres is the dedicated
+# paperless-db CNPG cluster in k8s/infra/databases (wave 2), redis is
+# in-cluster only (no PVC), media lives on the cp-3 USB HDD (see
+# k8s/infra/longhorn/longhorn-paperless-storageclass.yaml). OIDC via
+# Authentik provisioned by k8s/infra/iam's PostSync job; MinIO backup bucket
+# creds provisioned by k8s/infra/minio's PostSync job.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: paperless
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "8"
+spec:
+  project: homelab
+  source:
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
+    targetRevision: main
+    path: k8s/apps/paperless
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: paperless
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
 # Consolidated: homarr + homarr-patches → homarr
 # Helm chart + values + PostSync hook patch (fix-probes-job.yaml)
 apiVersion: argoproj.io/v1alpha1