fix(authelia): load rotated client verifier from secret file

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

sso-mfa/k8s/authelia/deployment.yaml

@@ -11,8 +11,8 @@
 #   4. This file
 #   5. ingress.yaml
 #
-# Sensitive values are passed as *_FILE env vars pointing to Secret-mounted files.
-# See configmap.yaml for the full list of injected secrets.
+# Sensitive values are passed as *_FILE env vars or the template filter,
+# pointing to Secret-mounted files. See configmap.yaml for the full list.
 
 apiVersion: apps/v1
 kind: Deployment
@@ -67,6 +67,10 @@ spec:
               value: /run/secrets/authelia/oidc_hmac_secret
             - name: AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE
               value: /run/secrets/authelia/oidc_issuer_private_key
+            # Required for the templated OIDC client verifier in
+            # authelia-config; list entries cannot use *_FILE overrides.
+            - name: X_AUTHELIA_CONFIG_FILTERS
+              value: template
 
           volumeMounts:
             # Config from ConfigMap