feat(keycloak): provision SSO client secrets + re-enable oauth2-proxy (R-IDP-01/02/04)

Generate the 3 OIDC client secrets (SOPS-encrypted, minimal manifests) so the realm
import can inject the grafana + oauth2-proxy client secrets and both consumers match:
- platform/keycloak/keycloak-realm-clients.sops.yaml (grafana + oauth2-proxy client secrets)
- platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml (client-id/secret/cookie)
- platform/monitoring/grafana-oidc-credentials.sops.yaml (grafana client secret)
Wire each into its component kustomization and re-enable oauth2-proxy in platform +
platform-config (reverses the temp deferral now that its secret exists).

Values generated by PM per operator instruction (random; recorded out-of-repo at
~/.config/home-k3s/keycloak-sso-secrets.txt for later rotation). Encrypted via sops in the
dev container to the age recipient in .sops.yaml; plaintext never committed.

Serves: R-IDP-01, R-IDP-02, R-IDP-04, R-SEC-01.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kustomization.yaml

@@ -28,12 +28,7 @@ resources:
   #      Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ----
   - cnpg               # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
   - keycloak           # Keycloak Operator (quay.io images) + SOPS admin credential
-  # TEMP-DEFERRED (PM, pending operator SOPS hand-off): oauth2-proxy's HelmRelease mounts
-  # `existingSecret: oauth2-proxy-credentials`, which is not yet provisioned. Under the unified graph's
-  # `platform` wait:true, a not-ready HR here blocks platform → platform-config → the whole downstream
-  # graph (incl. KubeVirt). Re-enable this line (and the two oauth2-proxy entries in platform-config)
-  # the moment the operator fills platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml + wires it.
-  # - oauth2-proxy     # forward-auth for non-OIDC UIs — needs SOPS `oauth2-proxy-credentials` (hand-off)
+  - oauth2-proxy       # forward-auth for non-OIDC UIs — SOPS oauth2-proxy-credentials now provisioned
   # ---- Later phases: enabled when their phase opens ----
   # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
   # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate