feat(wiki): deployable Wiki.js config job (#0049) — headless setup + OIDC + roles

Idempotent GraphQL bootstrap job (verified live): /finalize with the random SOPS
admin, then the OIDC strategy and the groups 'authentik Admins' (full) and
'wiki-anwender' (read /anwender), Guests locked. Replaces the manual setup wizard
entirely. OIDC client_id/secret in a SOPS secret; NetworkPolicy lets the job reach
wikijs. Script as a fixed-name ConfigMap; re-run = delete the Job.

apps/production/networkpolicy.yaml

@@ -377,6 +377,9 @@ spec:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: kube-system
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: wikijs-config   # Konfig-Job darf Wiki.js erreichen
       ports:
         - protocol: TCP
           port: http