feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

Fixes controlplane.tftpl's install.wipe:true (should be false, live CPs already run false) and syncs coredns Corefile back to what's actually deployed (drops an unrolled-out, stale Kong-era rewrite).

terraform/templates/controlplane.tftpl

@@ -47,7 +47,12 @@ machine:
   install:
     disk: ${install_disk}
     image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:${talos_version}
-    wipe: true
+    # false: these are already-installed, running control-plane nodes. wipe:
+    # true here would only be correct for a first-boot/bare-metal install
+    # flow; applying it to a live node via apply-config risks the install
+    # controller treating this as a reinstall request. Live config on all 3
+    # CPs already reports wipe: false - keep template and reality in sync.
+    wipe: false
     grubUseUKICmdline: true
 %{ if length(longhorn_disks) > 0 ~}
   disks: