feat: configure Kaneo

[glitchedmob]

Configure the identity, secrets, and AWS resources for Kaneo at projects.sgf.dev.

• Create a role-gated ZITADEL project and web OIDC application.
• Generate the OIDC client secret and persistent Kaneo authentication secret.
• Store application secrets in OpenBao using write-only values.
• Authorize the Kaneo service account to retrieve its secrets.
• Create a private, versioned, SSE-S3-encrypted bucket for Kaneo assets.
• Create a bounded workload-identity role with object-only access to that bucket.

[glitchedmob]

Merge this PR first. Its initial apply bootstraps and stores the OIDC client secret; after that succeeds, I will open the phase-two PR that switches the application to client-secret authentication.

[github-actions]

Terraform plan

Artifacts: https://github.com/sgfdevs/infra-app-config/actions/runs/33620011647

Show summary

CHANGE	RESOURCE
add (12)	module.kaneo.aws_iam_role.kaneo
	module.kaneo.aws_iam_role_policy.kaneo_assets
	module.kaneo.aws_s3_bucket.assets
	module.kaneo.aws_s3_bucket_cors_configuration.assets
	module.kaneo.aws_s3_bucket_ownership_controls.assets
	module.kaneo.aws_s3_bucket_policy.assets
	module.kaneo.aws_s3_bucket_public_access_block.assets
	module.kaneo.aws_s3_bucket_server_side_encryption_configuration.assets
	module.kaneo.aws_s3_bucket_versioning.assets
	module.kaneo.vault_kubernetes_auth_backend_role.secrets
	module.kaneo.vault_kv_secret_v2.app
	module.kaneo.vault_policy.secrets

Decrypt artifacts:
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.enc -out tfplan -pass pass:$OUTPUT_ENCRYPTION_KEY
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.txt.enc -out tfplan.txt -pass pass:$OUTPUT_ENCRYPTION_KEY