Add Gitea OAuth2/OIDC provider + application

Register the k8s Gitea forge as an Authentik OIDC app so it can use SSO at
cutover. Redirect URIs cover both the temporary git2 validation host and the
final git.unkin.net host so login works across the migration.

- add config/providers_oauth2/gitea.yaml (confidential OAuth2 provider + app,
  client_secret read from kv/kubernetes/namespace/gitea/default/oauth-credentials)

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

config/providers_oauth2/gitea.yaml

@@ -0,0 +1,25 @@
+# OAuth2/OIDC provider + application for the k8s Gitea forge.
+# Redirect URIs cover both the temporary validation host (git2...) and the final
+# git.unkin.net cutover host, so SSO keeps working across the migration. The
+# path segment "authentik" is the Gitea OAuth2 login-source name — it must match
+# the source registered on the Gitea side. client_secret is read from Vault
+# (seeded out of band), never committed.
+name: Gitea
+authorization_flow: default-provider-authorization-implicit-consent
+invalidation_flow: default-provider-invalidation-flow
+client_type: confidential
+client_id: gitea
+client_secret_vault:
+  mount: kv
+  path: kubernetes/namespace/gitea/default/oauth-credentials
+scope_mappings:
+  - goauthentik.io/providers/oauth2/scope-openid
+  - goauthentik.io/providers/oauth2/scope-email
+  - goauthentik.io/providers/oauth2/scope-profile
+redirect_uris:
+  # Temporary validation host.
+  - matching_mode: strict
+    url: https://git2.k8s.syd1.au.unkin.net/user/oauth2/authentik/callback
+  # Final host (active after DNS/cert cutover).
+  - matching_mode: strict
+    url: https://git.unkin.net/user/oauth2/authentik/callback