feat(infra): deploy Authentik (auth.dezky.eu) + global HTTP→HTTPS redirect

- Authentik on the in-cluster Postgres/Redis (mirrors the dev compose config:
  external DB/Redis, error-reporting off, update-check off, bootstrap admin),
  via the k3s Helm controller; Ingress + cert-manager letsencrypt-prod. Live at
  https://auth.dezky.eu (image 2026.5.2). Secrets generated on-box (Bitwarden).
- Traefik HelmChartConfig: global :80 -> :443 (308) redirect via
  additionalArguments (to=:443, HTTP-01-safe).
- RUNBOOK updated.

Deferred (mirror remaining dev bits): OIDC app blueprints (portal/operator with
prod URLs) + the cosmetic "Powered by Dezky" rebrand.

infrastructure/production/RUNBOOK.md

@@ -22,6 +22,9 @@ bottom to rebuild it. Per-layer detail lives in `host/README.md`,
 - **cert-manager** + `letsencrypt-staging` / `letsencrypt-prod` (HTTP-01/Traefik).
 - **Data tier** (`dezky-data` ns) — Postgres 16, Mongo 7, Redis 7 as
   StatefulSets on Longhorn PVCs. Postgres holds the `authentik` + `ocis` DBs.
+- **Authentik** (`dezky-auth` ns) — live at https://auth.dezky.eu (LE cert),
+  image `2026.5.2`, on our Postgres/Redis. `akadmin` bootstrap login.
+- **Traefik** — global HTTP→HTTPS 308 redirect (`fleet/traefik/`).
 
 ## Reproduce from scratch
 
@@ -82,6 +85,19 @@ kubectl apply -k fleet/data/
 kubectl -n dezky-data get pods,pvc      # all Running, PVCs Bound on longhorn
 ```
 
+### 6. Authentik (IdP)
+See `fleet/authentik/README.md`. Create `dezky-auth` ns + `authentik-secret`
+(DB/Redis pw read back from dezky-data so they match; SECRET_KEY + bootstrap
+generated), then `kubectl apply -f fleet/authentik/helmchart.yaml`. Reachable at
+https://auth.dezky.eu; first login `akadmin` / `AUTHENTIK_BOOTSTRAP_PASSWORD`.
+
+### 7. Traefik — global HTTP→HTTPS redirect
+```bash
+kubectl apply -f fleet/traefik/helmchartconfig.yaml
+kubectl -n kube-system delete job helm-install-traefik   # force the controller to re-run with merged values
+# verify: curl -sI http://auth.dezky.eu  ->  308 -> https://auth.dezky.eu/
+```
+
 ## Secrets — read live values for Bitwarden
 
 ```bash
@@ -95,8 +111,9 @@ k redis-secret REDIS_PASSWORD
 
 ## Still TODO (next layers)
 
-1. **Authentik** (`auth.dezky.eu`) — OIDC for the portal; uses the `authentik`
-   Postgres DB + Redis.
+1. **Authentik** — ✅ deployed (`auth.dezky.eu`). Remaining: OIDC app
+   blueprints (portal + operator, with prod redirect URLs + client secrets) and
+   the cosmetic rebrand. See `fleet/authentik/README.md`.
 2. **OCIS** (files) — uses the `ocis` Postgres DB + Hetzner Object Storage (S3).
 3. **Apps** — `fleet/apps/` (portal · platform-api · booking) + their secrets.
 4. **Stalwart** (host) — `host/stalwart/install.sh`; needs DNS + PTR.