Update Gitea OIDC redirect URIs to canonical + admin route

The k8s Gitea drops SSH and serves git.unkin.net (canonical) plus
git.k8s.syd1.au.unkin.net (admin/backup route, live now via external-dns).
Replace the old git2 validation host in the OAuth2 redirect URIs to match
argocd-apps#309.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

config/providers_oauth2/gitea.yaml

@@ -17,9 +17,9 @@ scope_mappings:
   - goauthentik.io/providers/oauth2/scope-email
   - goauthentik.io/providers/oauth2/scope-profile
 redirect_uris:
-  # Temporary validation host.
-  - matching_mode: strict
-    url: https://git2.k8s.syd1.au.unkin.net/user/oauth2/authentik/callback
-  # Final host (active after DNS/cert cutover).
+  # Canonical/production host (active after the git.unkin.net DNS cutover).
   - matching_mode: strict
     url: https://git.unkin.net/user/oauth2/authentik/callback
+  # Admin/backup route (live now via external-dns), used for validation too.
+  - matching_mode: strict
+    url: https://git.k8s.syd1.au.unkin.net/user/oauth2/authentik/callback