feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

Fixes controlplane.tftpl's install.wipe:true (should be false, live CPs already run false) and syncs coredns Corefile back to what's actually deployed (drops an unrolled-out, stale Kong-era rewrite).

k8s/infra/longhorn/kustomization.yaml

@@ -4,6 +4,7 @@ namespace: longhorn-system
 resources:
   - longhorn-storageclass.yaml
   - longhorn-cnpg-storageclass.yaml  # CNPG-specific with postgres UID/GID
+  - longhorn-paperless-storageclass.yaml  # single-replica, cp-3 USB HDD only
   - longhorn-servicemonitor.yaml
   - longhorn-taint-toleration.yaml
   - longhorn-nodes.yaml

k8s/infra/longhorn/longhorn-add-disks-job.yaml

@@ -1,6 +1,15 @@
 # PostSync hook Job that adds extra disks to Longhorn nodes.
 # talos-cp-2 has 4 extra disks mounted at /var/lib/longhorn-disk{1,2,3,4}
 # that are NOT auto-discovered by Longhorn.
+#
+# talos-cp-3 additionally gets a tagged disk for paperless-ngx media, backed by
+# the 4TB USB HDD (/dev/sdg) — tagged "paperless-media" so only the dedicated
+# longhorn-paperless-media StorageClass (diskSelector match) can place replicas
+# there, keeping it out of the default 3-replica pool. This patch is inert
+# until the Terraform machine-config change mounts the disk at
+# /var/lib/longhorn-paperless-media (pending — see terraform.tfvars.local,
+# not present in this checkout); Longhorn just reports the disk not-ready
+# until the path exists, no harm in applying it early.
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -83,6 +92,31 @@ spec:
             echo "  ✓ talos-cp-2 already has $CURRENT_DISKS disks configured"
           fi
           
+          echo "Checking talos-cp-3..."
+          CP3_DISKS=$(kubectl -n longhorn-system get nodes.longhorn.io talos-cp-3 -o json | jq -r '.spec.disks | keys | length')
+          echo "  Current disk count: $CP3_DISKS"
+
+          if [ "$CP3_DISKS" -lt 2 ]; then
+            echo "  Adding paperless-media disk to talos-cp-3..."
+            kubectl -n longhorn-system patch nodes.longhorn.io talos-cp-3 --type merge -p '{
+              "spec": {
+                "disks": {
+                  "paperless-media": {
+                    "allowScheduling": true,
+                    "diskType": "filesystem",
+                    "evictionRequested": false,
+                    "path": "/var/lib/longhorn-paperless-media",
+                    "storageReserved": 0,
+                    "tags": ["paperless-media"]
+                  }
+                }
+              }
+            }'
+            echo "  ✓ paperless-media disk added to talos-cp-3"
+          else
+            echo "  ✓ talos-cp-3 already has $CP3_DISKS disks configured"
+          fi
+
           echo
           echo "Waiting for disks to be ready..."
           sleep 10

k8s/infra/longhorn/longhorn-paperless-storageclass.yaml

@@ -0,0 +1,22 @@
+# Dedicated StorageClass for paperless-ngx document media, backed by the 4TB
+# USB HDD on talos-cp-3 (see longhorn-add-disks-job.yaml). Single disk, single
+# node — no Longhorn replica is possible, so numberOfReplicas is 1 by
+# necessity, not choice. diskSelector pins placement to the tagged disk only,
+# so a volume from this class never lands on cp-3's regular (already
+# DiskPressure) default pool. reclaimPolicy is Retain, not Delete: a PVC
+# accident here has no replica to fall back on, so an accidental delete must
+# not also take the underlying volume with it.
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-paperless-media
+provisioner: driver.longhorn.io
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+volumeBindingMode: WaitForFirstConsumer
+parameters:
+  numberOfReplicas: "1"
+  diskSelector: "paperless-media"
+  nodeSelector: "talos-cp-3"
+  staleReplicaTimeout: "30"
+  fsType: "ext4"