fix(oauth2-proxy): cookie-secret must be 32 raw bytes (hex16), not base64-44

oauth2-proxy read the base64 cookie value as raw bytes (44) → 'must be 16/24/32 bytes'
crashloop. Regenerated cookie-secret as openssl rand -hex 16 (32 bytes). client-id +
client-secret unchanged (still match the realm oauth2-proxy client). Value tracked in
~/.config/home-k3s/keycloak-sso-secrets.txt.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml

@@ -5,9 +5,9 @@ metadata:
     namespace: oauth2-proxy
 type: Opaque
 stringData:
-    client-id: ENC[AES256_GCM,data:YqWOatWC7SbM0yp4,iv:vMxhYu7PxLlTrjIcRMrWhN1r4cPiWAUtPrEyTeb3DiA=,tag:ZEVcSR8YaEVxiMj7IsRd8g==,type:str]
-    client-secret: ENC[AES256_GCM,data:DKxzn/nSQRWhKHzYqQNpmrnNmc0LzcIg+aUNODG6vd5TGMDkEQtsbR96j0PaS5MpNUraWKlo/GCKSPaZr/wqMA==,iv:IPRHbq0Nir90GZLjKPmqawdpRgzAf9mfs6mP5N0bwqI=,tag:Zuik7AN23lz408ikj67OtQ==,type:str]
-    cookie-secret: ENC[AES256_GCM,data:acF3v5BRojefjARfJB2udO2gaeffk64/0J+3YvOzvdHdtGk9lrXI/vuzC5A=,iv:EiloVBHhCWxgoGlbRruZUTgTB9/ekcQOHY7fmZPZu8I=,tag:+D4T7mNz1U8EnzErk98OyQ==,type:str]
+    client-id: ENC[AES256_GCM,data:20oGSPIZ8snVHSLB,iv:0vwysCCjH9wk2eX4h/Gy15UFU8LDmluVywXHXh8oCv4=,tag:rjyyt6UAg+b8aAWeSWoVVw==,type:str]
+    client-secret: ENC[AES256_GCM,data:C5mAVQTEoMWXcavNADbYWjcOQJVSa13DFRScwI7bpjtNrNuKAilD/13On+QnKsvh+IkUEk9O3Zv9iwpT7kWOFQ==,iv:hT76o2HC0OWDllacc59lCIHMqT1rePZ5vPxZmKbvEh4=,tag:Cd/cpWZvDpb2ny2LU0lKTw==,type:str]
+    cookie-secret: ENC[AES256_GCM,data:2o/Nr6qIlV07GV54uocRUfBYx/MXpilwO6t2adrUTIk=,iv:51qNjMdlARjw8FFftby+Vc4Ea8Z9CN6Hrev54pAXzCk=,tag:ke/JWhCNzw8bL92XkiHwaw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -17,14 +17,14 @@ sops:
         - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBac0gxeDFhbW8wNVY4SkNj
-            OWc2aVc3M1dzYmRxdkk3dWNJNkJKYk9qRUMwClBzVXBvUStKdW8wU3orWFlkTFFW
-            WkhyVGd4VVdMbmlMMUZ4VDA5M09lYmcKLS0tIGFXekE3ODFaNTlqR1RhS1N3SmhC
-            elUvK1l2Q1gvd0hFQXZrQUd1a29RQVEKQ/9keILThurYGEs5vbuRUghlyfpVpcDt
-            Gc0EGCN0ZZyV4zNmODX91Yubd7whUTl3WNs0n3TZfqXSeSP9bUFI+Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCZzFmLzM3bktMRDZ1K1hi
+            dHZsT2RoSTlPSyt4VzdMb3R6c3p0WTRhWDNzCkhsNjczeVVyLzMyNTYyeFR2ZmJ0
+            ZWVHT2t1elZDOXZEaXJ4eWZGU3NKdzAKLS0tIEdiZ1lrV1NUa2padk1LR29IUHlE
+            VGJWRGtOYnFnUXd2UHlTZ0dScDdCU0kKKyBfBHaNtoeh6VwFvWfQ5rvZOZioDfel
+            l/+ltorD9jOCyoS2Lzjw+88DfGinD5lCf1HVtti2G4Ry34yKL99/fQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-25T03:06:30Z"
-    mac: ENC[AES256_GCM,data:Q5dzE84NWDdZo9qrgPMJghF823nNr57bhg4CURfZHCoc1hkpsBNy0XVdbKfOt4wqvsy9ebL2s/vAhBlUJjqIgrk742YA+oUDkksII+CsldlECBTmFrJQULgmSIJgrlctgGP06wycnCL6dYvB+bnEG7hitlP9isoAyW0rQ7dUNmc=,iv:nIKr1zerrY6FEaOlu+hIBJYxK58GrV0NOeFpTzUFny4=,tag:lrC82Nt7/gZTZ6R3BjigpQ==,type:str]
+    lastmodified: "2026-08-25T03:17:09Z"
+    mac: ENC[AES256_GCM,data:oQoaPOhJ65waud26yqnlR4d3GunQ82oQHbZeCmsCFKt9es4UUNpHEiVfUXelsk/uqk2sIZr4B5dMJtqRQjCQR0yXmV1xJsVtAHpJ70sxvu5yf1nq9b96M2Ngv7KjcWjKuYesWboxChEGiRtISPnWckVBJmMKo33WwndM9gXd8pE=,iv:7LDbsfDW82ITWuOxY25mUmxAZ8tFQL668f3wVmfaabY=,tag:O0n8lJh45ZkECjpn+FscHg==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.4