Everything-is-an-app cutover: SSO/OIDC group (keycloak, oauth2-proxy, argocd, otomi-console)

[j-zimnowoda]

Parent

#3515

What to build

Cut the SSO / OIDC group of core apps over to the new git-driven layout. These apps are grouped because they share the same cross-cutting managed setting beyond the universal four: OIDC / Keycloak IdP client wiring (oidc.*, keycloak idp).

Apps in this batch:

• keycloak
• oauth2-proxy (and oauth2-proxy-redis)
• argocd
• otomi-console

End-to-end behavior per app: enabled in env/settings/apps.yaml; vendor-shaped values.custom.yaml + operator-rendered values.managed.yaml under env/values/<ns>/<release>/; multi-source Application CR file generated; legacy env/apps/<app>.yaml + inline-values path removed. OIDC client secrets appear in values.managed.yaml only as references to existing Secrets (SealedSecrets/ESO), never as literals — value files stay secret-free.

Note: argocd is the app hosting the app-of-apps; migrate its own values carefully so the root app and its Application file are not disrupted.

Acceptance criteria

• Each app reconciles Healthy in ArgoCD from its env/values/<ns>/<release>/{managed,custom}.yaml.
• OIDC/Keycloak wiring is emitted into values.managed.yaml as secret references (no literal secrets in value files).
• argocd's migration keeps the root app-of-apps functioning.
• Legacy env/apps/<app>.yaml entries and inline-values path removed for this batch.
• Existing installed: gating still works from env/settings/apps.yaml.

Blocked by

• Everything-is-an-app: pilot cert-manager end-to-end (app-of-apps + settings + values) #3571
• Everything-is-an-app: validate values.custom.yaml against vendor values.schema.json #3572
• Everything-is-an-app: render cert-manager -artifacts into git manifests (one object per file) #3573