Fix GitLab Authentik SSO: restore providers list, populate real provider key

GITLAB_OMNIBUS_CONFIG (gitlab_rails['omniauth_providers'] = [...]) is
an omnibus-Docker-image-only convention. This chart's CNG webservice
image never processes it - confirmed via gitlab/charts/gitlab/
templates/_omniauth.tpl, which only reads
global.appConfig.omniauth.providers (a list of {secret,key} refs, each
pointing at a Secret key holding a whole YAML-encoded provider block
loaded via Ruby's YAML.load_file). So GITLAB_OMNIBUS_CONFIG was always
a silent no-op on both home and VPS - neither ever actually had SSO
configured despite gitlab-oidc-secret existing and looking correct.

Yesterday's fix for 'FailedMount: references non-existent secret key:
provider' removed the providers: list entirely instead of populating
that key - stopped the crash, but also silently deleted the only real
OIDC config path on both sites (no error, login page just lost its SSO
button). This restores providers: on both, and gitlab-oidc-secret's
ExternalSecret template now actually renders a provider key containing
a real YAML provider block (with the templated client_id/secret
substituted in), matching what _omniauth.tpl expects.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure/vps-standby/gitlab/values.yaml

@@ -64,15 +64,13 @@ global:
       key: password
 
   appConfig:
-    # NOTE: no `providers:` list here - found live 2026-08-21: the chart
-    # requires gitlab-oidc-secret to have a `provider` key (full YAML
-    # provider config) when this is set, and it never does - only
-    # GITLAB_OIDC_CLIENT_ID/SECRET, consumed via extraEnvFrom +
-    # GITLAB_OMNIBUS_CONFIG below instead (the actual mechanism
-    # configuring OIDC). Caused "FailedMount: references non-existent
-    # secret key: provider" blocking webservice/sidekiq/toolbox from ever
-    # starting - see the matching fix + full explanation in
-    # apps/gitlab/values.yaml (home).
+    # CORRECTED 2026-08-21 (see apps/gitlab/values.yaml (home) for the
+    # full story) - `providers:` list restored, now pointing at
+    # gitlab-oidc-secret's `provider` key which holds a real
+    # YAML-encoded provider block (manifests/oidc-secret.yaml), the
+    # actual mechanism the CNG webservice image processes.
+    # GITLAB_OMNIBUS_CONFIG below is an omnibus-image-only convention
+    # this image never reads - always a no-op here.
     omniauth:
       enabled: true
       allowSingleSignOn: ['openid_connect']
@@ -80,6 +78,9 @@ global:
       autoLinkUser: ['openid_connect']
       syncProfileFromProvider: ['openid_connect']
       syncProfileAttributes: ['email', 'name']
+      providers:
+        - secret: gitlab-oidc-secret
+          key: provider
 
 # GitLab's pre-upgrade hook checks the deployed version against a
 # previous-release ConfigMap to enforce supported upgrade paths - found