feat(helm): complete chart normalization with ConfigMap, HPA, and OCI migration

- Added debug mode, structured ConfigMap pattern, and README to all charts
- Migrated all flat-structure charts to hierarchical values under chartname key
- Fixed templates to use correct hierarchical paths
- Renamed helm-rustical key to rustical, added HPA support
- Fixed ingress YAML parsing (oxicloud), nested env vars (rustical)
- Pushed all normalized charts to OCI registry as 1.0.0+ and updated ArgoCD apps

tofu/authentik/main.tf

@@ -1,9 +1,10 @@
 terraform {
   required_version = ">= 1.6"
   backend "s3" {
-    bucket = "fuku-terraform"
-    key    = "authentik/terraform"
-    region = "us-east-1"
+    bucket       = "fuku-terraform"
+    key          = "authentik/terraform"
+    region       = "us-east-1"
+    use_lockfile = "true"
   }
   required_providers {
     authentik = {
@@ -101,21 +102,6 @@ module "portainer" {
   sub_mode        = "hashed_user_id"
 }
 
-module "paperless" {
-  source              = "../modules/authentik-oidc"
-  app_name            = "Paperless"
-  app_slug            = "paperless"
-  client_id           = var.paperless_client_id
-  client_secret       = var.paperless_client_secret
-  app_access_group_id = ""
-  redirect_uris = [
-    { matching_mode = "strict", url = "https://paperless.roboces.dev/accounts/oidc/authentik/login/callback/" }
-  ]
-  app_icon        = "https://paperless.roboces.dev/favicon.ico"
-  app_description = "Document manager"
-  app_publisher   = "Paperless"
-  app_url         = "https://paperless.roboces.dev"
-}
 
 module "sonarr" {
   source                       = "../modules/authentik-proxy"
@@ -193,28 +179,6 @@ module "jellyfin" {
 }
 
 
-module "ganymede" {
-  source              = "../modules/authentik-oidc"
-  app_name            = "Ganymede"
-  app_slug            = "ganymede"
-  redirect_uris       = [{ matching_mode = "strict", url = "https://vods.roboces.dev/api/v1/auth/oauth/callback" }]
-  client_id           = var.ganymede_client_id
-  client_secret       = var.ganymede_client_secret
-  app_url             = "https://vods.roboces.dev"
-  app_icon            = "https://vods.roboces.dev/favicon.ico"
-  app_access_group_id = authentik_group.vods.id
-}
-
-module "jellyseerr" {
-  source              = "../modules/authentik-app"
-  app_name            = "Solicitudes Jelly"
-  app_slug            = "jellyseer"
-  app_url             = "https://requests.roboces.dev"
-  app_icon            = "https://requests.roboces.dev/os_icon.svg"
-  app_description     = "Solicita series, animes y pelis para ser añadidas automáticamente a Jellyfin"
-  app_access_group_id = authentik_group.arrs.id
-}
-
 module "cloud" {
   source        = "../modules/authentik-oidc"
   app_name      = "Cloud"

tofu/authentik/sample.env

@@ -12,5 +12,5 @@ TF_VAR_rustical_client_id=
 TF_VAR_rustical_client_secret=
 TF_VAR_ganymede_client_id=
 TF_VAR_ganymede_client_secret=
-TF_VAR_oxicloud_client_id=aef61f77326b813cf8d8ba71d1ac994b5642685ca37e4710ab0079e91d87702d55fd9775d473b05aff45603bf08e78dba26850af3a815f3c3ac171d163368aa0
-TF_VAR_oxicloud_client_secret=a4038df17c9fd06f86372aeaaae8f3fd1374d8978983af7b398d948ef15d1efe522a1faa2fc7652bc410c516d96cd2e4211dad4e05ba6297bdd8d9090460d5fc
+TF_VAR_oxicloud_client_id=
+TF_VAR_oxicloud_client_secret=