feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

Fixes controlplane.tftpl's install.wipe:true (should be false, live CPs already run false) and syncs coredns Corefile back to what's actually deployed (drops an unrolled-out, stale Kong-era rewrite).

k8s/infra/iam/scripts/authentik-provision.py

@@ -290,6 +290,17 @@ SERVICES = {
         "launch_url": "https://homarr.riotpiao.com",
         "display_name": "Homarr",
     },
+    "paperless": {
+        # No secret exists yet for paperless - generate + store on first run.
+        # django-allauth's generic openid_connect provider callback path is
+        # /accounts/oidc/<provider_id>/login/callback/ - provider_id "authentik"
+        # is set in PAPERLESS_SOCIALACCOUNT_PROVIDERS (see configmap.yaml).
+        "client_secret_source": ("paperless", "paperless-oidc", "CLIENT_SECRET"),
+        "generate_if_missing": True,
+        "redirect_uris": ["https://paperless.riotpiao.com/accounts/oidc/authentik/login/callback/"],
+        "launch_url": "https://paperless.riotpiao.com",
+        "display_name": "Paperless-ngx",
+    },
 }
 
 app_pks_for_binding = []
@@ -314,6 +325,32 @@ for name, cfg in SERVICES.items():
     else:
         print(f"  {name}: using existing client secret from {ns}/{secret_name}")
 
+    if name == "paperless":
+        # paperless-ngx's django-allauth OIDC config takes client_id/secret
+        # bundled inside one JSON blob (PAPERLESS_SOCIALACCOUNT_PROVIDERS), not
+        # discrete env vars - compose it here and store it alongside
+        # CLIENT_SECRET so the Deployment can source it directly via
+        # secretKeyRef, no shell wrapper needed. Runs every time (not just on
+        # generate), so it stays in sync if the client_secret is ever rotated
+        # by hand.
+        providers_json = json.dumps({
+            "openid_connect": {
+                "APPS": [{
+                    "provider_id": "authentik",
+                    "name": "Authentik",
+                    "client_id": "paperless",
+                    "secret": client_secret,
+                    "settings": {
+                        "server_url": "https://authentik.riotpiao.com/application/o/paperless/.well-known/openid-configuration",
+                    },
+                }],
+            },
+        })
+        kubectl_create_secret("paperless", "paperless-oidc", {
+            "CLIENT_SECRET": client_secret,
+            "SOCIALACCOUNT_PROVIDERS_JSON": providers_json,
+        })
+
     provider = get_or_create(
         "/api/v3/providers/oauth2/", "/api/v3/providers/oauth2/",
         f"name={name}",