feat(sso): complete MinIO OIDC env + add Homarr landing page base config

MinIO (Part B):
- k8s/infrastructure/minio/minio-tenant.yaml: added full OIDC env block
  (CONFIG_URL, CLIENT_ID, CLIENT_SECRET from minio-oidc secret, CLAIM_NAME,
  REDIRECT_URI, DISPLAY_NAME, SCOPES) — MinIO console SSO login will now work

Homarr (Part C1 - base):
- k8s/applications/homarr/homarr-values.yaml: official chart config with
  Authentik SSO (AUTH_PROVIDERS=oidc, all OIDC env vars, client creds from
  homarr-oidc secret, SECRET_ENCRYPTION_KEY from SOPS secret)
- k8s/applications/homarr/homarr-secrets.enc.yaml: age-encrypted
  SECRET_ENCRYPTION_KEY (stable key — rotating it breaks saved integrations)
- k8s/applications/homarr/kustomization.yaml: namespace dashboard

Still TODO for Homarr:
- Add 'homarr' to authentik-provision.py SERVICES dict
- Add Application to 60-applications.yaml (multi-source: chart + values)
- Add ingress rule (k8s/bootstrap/ingress/ingress.yaml)
- Add CoreDNS rewrite (k8s/bootstrap/coredns/coredns-configmap.yaml)
- Add dashboard RoleBinding for authentik-provisioner SA

k8s/infrastructure/minio/minio-tenant.yaml

@@ -96,5 +96,20 @@ spec:
 
   # ── OIDC via Authentik (server-side env, valid in v2 schema) ────────────────
   env:
+    - name: MINIO_IDENTITY_OPENID_CONFIG_URL
+      value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
+    - name: MINIO_IDENTITY_OPENID_CLIENT_ID
+      value: "minio"
+    - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: minio-oidc
+          key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
+    - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
+      value: "policy"
+    - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
+      value: "https://minio.riotpiao.com/oauth_callback"
+    - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
+      value: "Authentik"
     - name: MINIO_IDENTITY_OPENID_SCOPES
       value: "openid,profile,email,minio"