vlogs is the first app to need a second OIDC secret in a namespace that
already has one, so the one-per-namespace oauth-credentials wildcard does
not cover it and the authentik plan fails on a denied kv read.
- grant read on kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials