identity.unkin.net was configured as the Authentik OIDC issuer but has no DNS
record anywhere, so in-cluster OIDC discovery (e.g. argocd-server) fails to
resolve it. Add an authoritative A record via the bind-operator so the
internal bind system serves it.
- New DNSRecord identity-dns-internal -> 198.18.200.4 (traefik-internal VIP,
where the authentik Gateway serves the identity.unkin.net hostname).
- Placed in the bind-internal namespace alongside the unkin-net BindZone: the
operator resolves zoneRef/clusterRef/updateKeyRef within the record's own
namespace, so it cannot live in the app namespace.
- "internal" in the name distinguishes it from the external DNS Authentik will
manage its own records from later.
