feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

Fixes controlplane.tftpl's install.wipe:true (should be false, live CPs already run false) and syncs coredns Corefile back to what's actually deployed (drops an unrolled-out, stale Kong-era rewrite).

terraform/files/coredns/Corefile

@@ -33,11 +33,6 @@
     rewrite name homarr.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name portainer.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
-    # Kong API gateway. Points at nginx, not kong-proxy, for the same reason as
-    # the rest: a direct rewrite would skip TLS termination. Pods that don't
-    # need TLS should call kong-proxy.api.svc.cluster.local instead of using
-    # this name at all.
-    rewrite name api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
     kubernetes cluster.local in-addr.arpa ip6.arpa {
         pods insecure

terraform/templates/controlplane.tftpl

@@ -47,7 +47,12 @@ machine:
   install:
     disk: ${install_disk}
     image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:${talos_version}
-    wipe: true
+    # false: these are already-installed, running control-plane nodes. wipe:
+    # true here would only be correct for a first-boot/bare-metal install
+    # flow; applying it to a live node via apply-config risks the install
+    # controller treating this as a reinstall request. Live config on all 3
+    # CPs already reports wipe: false - keep template and reality in sync.
+    wipe: false
     grubUseUKICmdline: true
 %{ if length(longhorn_disks) > 0 ~}
   disks: