feat(keycloak): provision SSO client secrets + re-enable oauth2-proxy (R-IDP-01/02/04)

Generate the 3 OIDC client secrets (SOPS-encrypted, minimal manifests) so the realm
import can inject the grafana + oauth2-proxy client secrets and both consumers match:
- platform/keycloak/keycloak-realm-clients.sops.yaml (grafana + oauth2-proxy client secrets)
- platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml (client-id/secret/cookie)
- platform/monitoring/grafana-oidc-credentials.sops.yaml (grafana client secret)
Wire each into its component kustomization and re-enable oauth2-proxy in platform +
platform-config (reverses the temp deferral now that its secret exists).

Values generated by PM per operator instruction (random; recorded out-of-repo at
~/.config/home-k3s/keycloak-sso-secrets.txt for later rotation). Encrypted via sops in the
dev container to the age recipient in .sops.yaml; plaintext never committed.

Serves: R-IDP-01, R-IDP-02, R-IDP-04, R-SEC-01.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/monitoring/grafana-oidc-credentials.sops.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: grafana-oidc-credentials
+    namespace: monitoring
+type: Opaque
+stringData:
+    client-secret: ENC[AES256_GCM,data:yq81eILYDrasFchtD+375EYmKYc38NMblbvRdDVhRpmRO/4d6/QVzfVDG4WrrREjkOaDbj/7Qkw25EX2NEQTyg==,iv:m4pQdOR2VJMTRJ/TxWaLOUN3rLzoCuvlaLgoo2AU7os=,tag:scoKscvm2sA+zDLnN1ub7w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWdy8wc25KdTZVQzV5YlBs
+            WDFDRHgwN0RpdlRiWGZsQUJDZGthcWI0cVZzCm0wUHc4Y1dwcEVFQ2U4c2o0ZWd5
+            Y0htSm1laWt2ZmFBTkNMYjlKeUNyV0UKLS0tIHdwTDNWNWNhM2RseGd5SzVVdTVw
+            MTNHY2xiNTVFdkhobEp0MGFjOEJLYUUK8i5l3GQnxQlS9U53jOOsyqaVdqUA/jxv
+            Cmix6W9abwRntFwJYTQk3Hcl6HW0BcP1uUpPuOxaIzk8F52U1A4AOw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-25T03:06:30Z"
+    mac: ENC[AES256_GCM,data:Y0f9W7IfJZf0VXHG9XYrxV7ueZ1RYKye/Z9smGUD+eUeY3c8QKaqc+SLsEH1BPxlUkZUTDHZzD2jtl0Rs+bL2N51uskQyeW/ksDBuCoZjHZGwAeTiQG/ZMoL9iJXjCDc74h5DTqqkL2aEBozux9kNw9MiiV1uKupT2JFlcA0srw=,iv:lveLPR61E41altRc9o4O52ThnLnMeU/8gqdS1WcWXmk=,tag:rH3/qsp8+GReQZKJpFqAfA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4

platform/monitoring/kustomization.yaml

@@ -12,3 +12,4 @@ resources:
   # (dependsOn platform) so the CRDs exist first. File stays here for locality.
   - grafana-admin-credentials.sops.yaml
   - alertmanager-smtp.sops.yaml
+  - grafana-oidc-credentials.sops.yaml