feat(infra): deploy Authentik (auth.dezky.eu) + global HTTP→HTTPS redirect

- Authentik on the in-cluster Postgres/Redis (mirrors the dev compose config:
  external DB/Redis, error-reporting off, update-check off, bootstrap admin),
  via the k3s Helm controller; Ingress + cert-manager letsencrypt-prod. Live at
  https://auth.dezky.eu (image 2026.5.2). Secrets generated on-box (Bitwarden).
- Traefik HelmChartConfig: global :80 -> :443 (308) redirect via
  additionalArguments (to=:443, HTTP-01-safe).
- RUNBOOK updated.

Deferred (mirror remaining dev bits): OIDC app blueprints (portal/operator with
prod URLs) + the cosmetic "Powered by Dezky" rebrand.

infrastructure/production/fleet/authentik/values.yaml

@@ -0,0 +1,55 @@
+# Authentik production Helm values — mirrors the dev docker-compose service
+# (ghcr.io/goauthentik/server:2025.10), pointed at the in-cluster data tier.
+#
+# Secrets come from the 'authentik-secret' Secret via global.envFrom (generated
+# on-box; see README) — NEVER in this file. Non-secret config only here.
+#
+# NOTE: chart version is intentionally unpinned at first install (helm-controller
+# pulls latest). After it's up, pin the installed chart + image versions here +
+# in RUNBOOK.md for reproducibility.
+
+image:
+  tag: "2026.5.2"   # deployed version (latest chart as of 2026-06-08)
+
+global:
+  # AUTHENTIK_SECRET_KEY, AUTHENTIK_POSTGRESQL__PASSWORD, AUTHENTIK_REDIS__PASSWORD,
+  # AUTHENTIK_BOOTSTRAP_PASSWORD, AUTHENTIK_BOOTSTRAP_TOKEN
+  envFrom:
+    - secretRef:
+        name: authentik-secret
+  env:
+    - name: AUTHENTIK_BOOTSTRAP_EMAIL
+      value: admin@dezky.eu
+    - name: AUTHENTIK_DISABLE_UPDATE_CHECK
+      value: "true"
+
+authentik:
+  error_reporting:
+    enabled: false
+  postgresql:
+    host: postgres.dezky-data
+    name: authentik
+    user: authentik
+  redis:
+    host: redis.dezky-data
+
+# Use the in-cluster data tier, not the chart's bundled subcharts.
+postgresql:
+  enabled: false
+redis:
+  enabled: false
+
+server:
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    annotations:
+      cert-manager.io/cluster-issuer: letsencrypt-prod
+    hosts:
+      - auth.dezky.eu
+    paths:
+      - "/"
+    tls:
+      - hosts:
+          - auth.dezky.eu
+        secretName: authentik-tls