feat(infra): Authentik blueprints (portal+operator OIDC, dezky brand)

Mirror the dev Authentik config in prod via blueprints, applied & successful on
node1:
- brand.yaml: dezky branding on the default brand (title + signal-green custom
  CSS) — login page now in dezky colors.
- portal-application.yaml / operator-application.yaml: dezky-portal &
  dezky-operator OIDC apps/providers (prod redirect URLs) + the
  dezky-platform-admins group & operator access policy.

Two 2026.5 gotchas handled + documented in README:
- invalidation_flow is now REQUIRED on OAuth2 providers (added via !Find).
- ConfigMap mounts are symlinks (discovery can't read them) → worker uses an
  initContainer that copies them to an emptyDir as real files. (chart
  worker.volumes didn't apply on this version; patch reverts on helm upgrade —
  noted as a durability TODO.)

Client secrets (PORTAL/OPERATOR_OIDC_CLIENT_SECRET) live in authentik-secret;
the apps must reuse them.

infrastructure/production/fleet/authentik/README.md

@@ -36,14 +36,40 @@ kubectl -n dezky-auth get secret authentik-secret -o jsonpath='{.data.AUTHENTIK_
 ```
 Log in at https://auth.dezky.eu as **akadmin** / that password.
 
-## TODO (mirror the rest of dev — not yet applied)
-- **OIDC app blueprints.** Dev provisions the operator app + a
-  `dezky-platform-admins` access policy via a blueprint
-  (`infrastructure/docker-compose/configs/authentik/blueprints/`). For prod,
-  mount the equivalent at `/blueprints/custom` with **prod** redirect URLs
-  (`operator.dezky.eu`, `app.dezky.eu`) + the matching client IDs/secrets.
-  The portal OIDC client (hand-made in dev) also needs creating.
-- **Rebrand** ("Powered by authentik" → "Powered by Dezky"): dev runs
-  `rebrand-web.sh` as a root lifecycle script. Replicating in k8s needs a
-  root-capable initContainer/command override — cosmetic, deferred.
+## Blueprints + branding (APPLIED)
+
+`blueprints/` holds prod blueprints (applied & `successful` on node1):
+- `brand.yaml` — dezky branding on the default brand (title + signal-green
+  custom CSS). **This is what puts the login page in dezky colors.**
+- `portal-application.yaml` — `dezky-portal` OIDC app/provider
+  (`https://app.dezky.eu/api/auth/callback`).
+- `operator-application.yaml` — `dezky-operator` OIDC app/provider
+  (`https://operator.dezky.eu/auth/oidc/callback`) + `dezky-platform-admins`
+  group + an access policy restricting operator login to that group.
+
+Client secrets live in `authentik-secret` (`PORTAL_OIDC_CLIENT_SECRET`,
+`OPERATOR_OIDC_CLIENT_SECRET`) — the apps must reuse the SAME values.
+
+### Applying them (two gotchas, both handled)
+1. **`invalidation_flow` is REQUIRED** on OAuth2 providers in Authentik 2026.5
+   (dev's 2025.10 didn't need it) — both providers set it via `!Find`.
+2. **ConfigMap mounts present files as symlinks**, which Authentik's discovery
+   won't read. So the worker uses an **initContainer that copies the ConfigMap
+   into an emptyDir as real files** at `/blueprints/custom`:
+   ```bash
+   kubectl -n dezky-auth create configmap authentik-blueprints \
+     --from-file=blueprints/ --dry-run=client -o yaml | kubectl apply -f -
+   # patch worker: add bp-src(configMap) + bp-cust(emptyDir) + initContainer
+   #   `cp -L /bp-src/*.yaml /bp-cust/`, mount bp-cust at /blueprints/custom
+   kubectl -n dezky-auth rollout restart deploy/authentik-worker
+   # apply each (or let discovery): ak apply_blueprint custom/<file>.yaml
+   ```
+   > The chart's `worker.volumes` value did NOT take effect on this chart
+   > version, hence the direct Deployment patch. **Caveat:** a helm upgrade of
+   > Authentik reverts the patch — re-apply it (move it into a custom image or a
+   > post-render kustomize patch to make it durable). TODO.
+
+## Still deferred
+- **Rebrand** of the "Powered by authentik" string (web-bundle `sed`, needs a
+  root lifecycle override) — cosmetic; the *colors* are done via the brand CSS.
 - Pin the **chart version** (currently latest → app `2026.5.2`).