Wire LiteLLM SSO to Authentik (generic OIDC)

App-side of the LiteLLM Authentik onboarding (terraform-authentik#8). Configures
LiteLLM's generic OIDC SSO against Authentik.

- VaultStaticSecret oauth-credentials: surfaces the OIDC client secret (same
  secret Authentik sets on the provider) as a k8s Secret.
- Deployment: GENERIC_CLIENT_SECRET from that Secret.
- litellm-env: GENERIC_CLIENT_ID, authorization/token/userinfo endpoints, scope,
  and PROXY_BASE_URL (required for SSO). reloader restarts on secret/config change.

apps/base/litellm/deployment.yaml

@@ -30,6 +30,14 @@ spec:
             - containerPort: 4000
               name: http
               protocol: TCP
+          env:
+            # Authentik OIDC client secret (SSO); non-secret SSO config is in the
+            # litellm-env ConfigMap.
+            - name: GENERIC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
           envFrom:
             - secretRef:
                 name: litellm-credentials