chore: retire the self-hosted zitadel

remove the in-cluster zitadel instance (helmrelease, cnpg database, secrets,
admin-sa pushsecret) and the terraform module that configured it. all app
consumers have moved to the cloud zitadel at auth.internal.futo.org.

the module's resources must be destroyed with `terragrunt destroy` BEFORE this
merges, while the instance is still reachable, so the ZITADEL_OAUTH_CLIENT_ID/
SECRET_* 1password items and the zitadel org/projects/users are cleaned up
rather than orphaned. see the PR description for the full teardown sequence.

Author: zackpollard

kubernetes/apps/authentication/kustomization.yaml

@@ -3,4 +3,3 @@ kind: Kustomization
 resources:
   - ./namespace.yaml
   - ./oauth2-proxy/ks.yaml
-  - ./zitadel/ks.yaml