feat(infra): Authentik blueprints (portal+operator OIDC, dezky brand)

Mirror the dev Authentik config in prod via blueprints, applied & successful on
node1:
- brand.yaml: dezky branding on the default brand (title + signal-green custom
  CSS) — login page now in dezky colors.
- portal-application.yaml / operator-application.yaml: dezky-portal &
  dezky-operator OIDC apps/providers (prod redirect URLs) + the
  dezky-platform-admins group & operator access policy.

Two 2026.5 gotchas handled + documented in README:
- invalidation_flow is now REQUIRED on OAuth2 providers (added via !Find).
- ConfigMap mounts are symlinks (discovery can't read them) → worker uses an
  initContainer that copies them to an emptyDir as real files. (chart
  worker.volumes didn't apply on this version; patch reverts on helm upgrade —
  noted as a durability TODO.)

Client secrets (PORTAL/OPERATOR_OIDC_CLIENT_SECRET) live in authentik-secret;
the apps must reuse them.

infrastructure/production/fleet/authentik/helmchart.yaml

@@ -53,3 +53,8 @@ spec:
           - hosts:
               - auth.dezky.eu
             secretName: authentik-tls
+    # NOTE: blueprints are mounted via a post-install initContainer patch on the
+    # worker Deployment (this chart version ignored worker.volumes here) — it
+    # copies the 'authentik-blueprints' ConfigMap into an emptyDir as real files
+    # at /blueprints/custom. See README "Blueprints + branding". Client secrets
+    # come from authentik-secret (PORTAL_OIDC_CLIENT_SECRET / OPERATOR_OIDC_CLIENT_SECRET).