feat: add harbor registry with authentik oidc

Harbor 2.15 (chart 1.19.1) as a services-group app: CNPG-backed external
postgres, internal redis, hcloud-volumes persistence, exposed through the
public gateway at harbor.tibor.sh.

All chart-generated component secrets are pinned via existingSecret
references (sops-encrypted, age-only recipients) so ArgoCD renders stay
deterministic. OIDC is wired both ways: an authentik blueprint creates
the provider/application (client secret via authentik-oidc-clients env
secret), and a post-deploy job PUTs the matching oidc_auth config into
Harbor's API. tibor joins the new harbor-admins group for oidc admin.

rework: single terragrunt + argocd application layer

main advanced the old three-stage Terraform module architecture
(terragrunt/{foundation,extensions} with Keycloak, RKE, metallb,
ingress-nginx, rancher) via renovate bumps and further module
refactoring. This branch already abandoned that architecture wholesale
in the "fresh slate" commit (11e7fa6) in favor of a single terragrunt
provisioning unit plus an ArgoCD-managed applications/ layer, and never
reinstated it across 100+ subsequent commits.

Conflict resolution keeps this branch's architecture throughout:
- All old-architecture files under terragrunt/foundation/**,
terragrunt/extensions/**, and old keycloak templates stay deleted,
including new content main added there after the branches diverged.
- terragrunt/cluster/{main.tf,terragrunt.hcl}, README.md,
applications/kustomization.yaml, and shell.nix keep this branch's
versions, which already reflect the new architecture.
- scripts/init_gitlab.sh, renovate.json, scripts/create_docs.sh, and
terragrunt/README.md stay dropped, matching the "fresh slate" intent
(they configure/document the old architecture and were never
reintroduced on this branch).
- applications/README.md is taken from main as-is: it's a new,
architecture-agnostic addition that doesn't conflict with anything
here.

argocd-oidc was already covered by applications/argocd/blueprints/oidc.yaml;
omni/pds/tekton/woodpecker were duplicates of their ArgoCD applications. The
enrollment/invitation flow moves to applications/authentik/blueprints/enrollment.yaml.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Add DNSEndpoint CRD to bootstrap, enable crd source and TXT record
management so external-dns can create arbitrary DNS records from
DNSEndpoint resources.

Switch from did:web to did:plc from self-hosted PDS, drop the nginx
did-web sidecar and id.tibor.sh route, fix image to docker.io/itszero,
fix DB path and add init container for volume permissions.

kustomize app at applications/pds/ with SOPS-encrypted secrets,
HTTPRoutes for pds.tibor.sh and tibor.tibor.sh handle verification,
and a DNSEndpoint for the _atproto TXT record via external-dns.