feat(keycloak): provision SSO client secrets + re-enable oauth2-proxy (R-IDP-01/02/04)

Generate the 3 OIDC client secrets (SOPS-encrypted, minimal manifests) so the realm
import can inject the grafana + oauth2-proxy client secrets and both consumers match:
- platform/keycloak/keycloak-realm-clients.sops.yaml (grafana + oauth2-proxy client secrets)
- platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml (client-id/secret/cookie)
- platform/monitoring/grafana-oidc-credentials.sops.yaml (grafana client secret)
Wire each into its component kustomization and re-enable oauth2-proxy in platform +
platform-config (reverses the temp deferral now that its secret exists).

Values generated by PM per operator instruction (random; recorded out-of-repo at
~/.config/home-k3s/keycloak-sso-secrets.txt for later rotation). Encrypted via sops in the
dev container to the age recipient in .sops.yaml; plaintext never committed.

Serves: R-IDP-01, R-IDP-02, R-IDP-04, R-SEC-01.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml

@@ -1,32 +1,30 @@
-# =============================================================================
-# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
-# and never auto-encrypted by SOPS). Reference scaffold only.
-#
-# (a) Copy to:      platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml
-# (b) kustomization: add this line under `resources:` in
-#                    platform/oauth2-proxy/kustomization.yaml
-#                       - oauth2-proxy-credentials.sops.yaml
-# (c) Encrypt:       sops -e -i platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml
-# (d) Consumed by:   oauth2-proxy Helm chart -> existingSecret. [Phase 6]
-#
-# VALUE NOTES:
-#  - client-id / client-secret: come from the Keycloak OIDC client created for
-#    oauth2-proxy (Phase 6, after Keycloak is up).
-#  - cookie-secret: must be a 16, 24, or 32-byte value, base64-encoded.
-#    Generate with:  openssl rand -base64 32
-#
-# !! VERIFY KEY NAMES BEFORE ENCRYPTING !!
-# Confirm the exact stringData key names against the pinned oauth2-proxy chart's
-# existingSecret contract (common keys: client-id, client-secret, cookie-secret,
-# but chart versions vary). Adjust below to match before running `sops -e -i`.
-# =============================================================================
 apiVersion: v1
 kind: Secret
 metadata:
-  name: oauth2-proxy-credentials
-  namespace: oauth2-proxy
+    name: oauth2-proxy-credentials
+    namespace: oauth2-proxy
 type: Opaque
 stringData:
-  client-id: REPLACE-ME
-  client-secret: REPLACE-ME
-  cookie-secret: REPLACE-ME
+    client-id: ENC[AES256_GCM,data:YqWOatWC7SbM0yp4,iv:vMxhYu7PxLlTrjIcRMrWhN1r4cPiWAUtPrEyTeb3DiA=,tag:ZEVcSR8YaEVxiMj7IsRd8g==,type:str]
+    client-secret: ENC[AES256_GCM,data:DKxzn/nSQRWhKHzYqQNpmrnNmc0LzcIg+aUNODG6vd5TGMDkEQtsbR96j0PaS5MpNUraWKlo/GCKSPaZr/wqMA==,iv:IPRHbq0Nir90GZLjKPmqawdpRgzAf9mfs6mP5N0bwqI=,tag:Zuik7AN23lz408ikj67OtQ==,type:str]
+    cookie-secret: ENC[AES256_GCM,data:acF3v5BRojefjARfJB2udO2gaeffk64/0J+3YvOzvdHdtGk9lrXI/vuzC5A=,iv:EiloVBHhCWxgoGlbRruZUTgTB9/ekcQOHY7fmZPZu8I=,tag:+D4T7mNz1U8EnzErk98OyQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBac0gxeDFhbW8wNVY4SkNj
+            OWc2aVc3M1dzYmRxdkk3dWNJNkJKYk9qRUMwClBzVXBvUStKdW8wU3orWFlkTFFW
+            WkhyVGd4VVdMbmlMMUZ4VDA5M09lYmcKLS0tIGFXekE3ODFaNTlqR1RhS1N3SmhC
+            elUvK1l2Q1gvd0hFQXZrQUd1a29RQVEKQ/9keILThurYGEs5vbuRUghlyfpVpcDt
+            Gc0EGCN0ZZyV4zNmODX91Yubd7whUTl3WNs0n3TZfqXSeSP9bUFI+Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-25T03:06:30Z"
+    mac: ENC[AES256_GCM,data:Q5dzE84NWDdZo9qrgPMJghF823nNr57bhg4CURfZHCoc1hkpsBNy0XVdbKfOt4wqvsy9ebL2s/vAhBlUJjqIgrk742YA+oUDkksII+CsldlECBTmFrJQULgmSIJgrlctgGP06wycnCL6dYvB+bnEG7hitlP9isoAyW0rQ7dUNmc=,iv:nIKr1zerrY6FEaOlu+hIBJYxK58GrV0NOeFpTzUFny4=,tag:lrC82Nt7/gZTZ6R3BjigpQ==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4