fix(authelia): load rotated client verifier from secret file

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

sso-mfa/k8s/authelia/configmap.yaml

@@ -9,10 +9,10 @@
 #   AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE
 #   AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE
 #   AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE
-#   AUTHELIA_IDENTITY_PROVIDERS_OIDC_CLIENTS_0_SECRET_FILE
 #
 # The *_FILE convention tells Authelia to read the secret from a file path
-# (mounted from the authelia-secrets K8s Secret — see deployment.yaml).
+# (mounted from the authelia-secrets K8s Secret — see deployment.yaml). The
+# OIDC client verifier is a list entry and is loaded with the template filter.
 #
 # Access control policy is deliberately set to one_factor (password only).
 # MFA is handled out-of-band by KeyCape via the privacyIDEA adapter AFTER
@@ -120,8 +120,10 @@ data:
         clients:
           - id: keycape
             description: "KeyCape IAM Orchestration Layer"
-            # bcrypt hash of the KeyCape OIDC client secret (hash is not sensitive — safe in ConfigMap)
-            secret: "$2b$12$W/ct2nasY4wruQrFVh33UO5qgoxYTBNVvTBqfZHMwBVll13ZeCli."
+            # OIDC clients are a list, so Authelia's *_FILE environment
+            # mechanism cannot override this field. The template filter reads
+            # the bcrypt verifier from the Secret-mounted file at startup.
+            secret: '{{ secret "/run/secrets/authelia/keycape_client_secret_hash" }}'
             public: false
             authorization_policy: one_factor
             consent_mode: implicit