feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

Fixes controlplane.tftpl's install.wipe:true (should be false, live CPs already run false) and syncs coredns Corefile back to what's actually deployed (drops an unrolled-out, stale Kong-era rewrite).

k8s/infra/longhorn/longhorn-paperless-storageclass.yaml

@@ -0,0 +1,22 @@
+# Dedicated StorageClass for paperless-ngx document media, backed by the 4TB
+# USB HDD on talos-cp-3 (see longhorn-add-disks-job.yaml). Single disk, single
+# node — no Longhorn replica is possible, so numberOfReplicas is 1 by
+# necessity, not choice. diskSelector pins placement to the tagged disk only,
+# so a volume from this class never lands on cp-3's regular (already
+# DiskPressure) default pool. reclaimPolicy is Retain, not Delete: a PVC
+# accident here has no replica to fall back on, so an accidental delete must
+# not also take the underlying volume with it.
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-paperless-media
+provisioner: driver.longhorn.io
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+volumeBindingMode: WaitForFirstConsumer
+parameters:
+  numberOfReplicas: "1"
+  diskSelector: "paperless-media"
+  nodeSelector: "talos-cp-3"
+  staleReplicaTimeout: "30"
+  fsType: "ext4"