fix(minio): use in-cluster URL for OIDC config fetch

MinIO pod was getting 503 from public URL at startup. Use in-cluster
authentik-server.iam.svc for metadata fetch; browser redirects still
use public URLs from OIDC metadata response.

k8s/infra/minio/minio-tenant.yaml

@@ -96,9 +96,11 @@ spec:
       console: https://minio.riotpiao.com
 
   # ── OIDC via Authentik (server-side env, valid in v2 schema) ────────────────
+  # Use in-cluster URL for config fetch (pod→authentik); browser redirects use
+  # public URLs embedded in the OIDC metadata response (issuer stays public).
   env:
     - name: MINIO_IDENTITY_OPENID_CONFIG_URL
-      value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
+      value: "http://authentik-server.iam.svc.cluster.local/application/o/minio/.well-known/openid-configuration"
     - name: MINIO_IDENTITY_OPENID_CLIENT_ID
       value: "minio"
     - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET