feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

Fixes controlplane.tftpl's install.wipe:true (should be false, live CPs already run false) and syncs coredns Corefile back to what's actually deployed (drops an unrolled-out, stale Kong-era rewrite).

k8s/infra/minio/kustomization.yaml

@@ -1,8 +1,14 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: storage
+# NOTE: no top-level `namespace:` transformer (see iam/kustomization.yaml for
+# the same fix) - minio-provision-paperless-job.yaml's RoleBinding
+# deliberately targets namespace paperless (least-privilege access for the
+# provisioner ServiceAccount to write Secrets there); a namespace transformer
+# would silently rewrite it back to storage, breaking the RBAC. Every resource
+# here already sets its own explicit metadata.namespace.
 resources:
   - minio-tenant.yaml
+  - minio-provision-paperless-job.yaml
 # The operator creates the minio S3/console/headless Services and the
 # declarative bucket + user from the Tenant spec — no hand-rolled Service or
 # Bucket/User CRs (those kinds don't exist in the operator CRD set).