Everything-is-an-app cutover: SSO/OIDC group (keycloak, oauth2-proxy, argocd, otomi-console)

Nobody has claimed this yet.

## Parent

linode/apl-core#3515

## What to build

Cut the **SSO / OIDC** group of core apps over to the new git-driven layout. These apps are grouped because they share the same cross-cutting managed setting beyond the universal four: OIDC / Keycloak IdP client wiring (`oidc.*`, keycloak `idp`).

Apps in this batch:
- `keycloak`
- `oauth2-proxy` (and `oauth2-proxy-redis`)
- `argocd`
- `otomi-console`

End-to-end behavior per app: `enabled` in `env/settings/apps.yaml`; vendor-shaped `values.custom.yaml` + operator-rendered `values.managed.yaml` under `env/values///`; multi-source `Application` CR file generated; legacy `env/apps/.yaml` + inline-values path removed. OIDC client secrets appear in `values.managed.yaml` only as **references** to existing Secrets (SealedSecrets/ESO), never as literals — value files stay secret-free.

Note: `argocd` is the app hosting the app-of-apps; migrate its own values carefully so the root app and its Application file are not disrupted.

## Acceptance criteria

- [ ] Each app reconciles Healthy in ArgoCD from its `env/values///{managed,custom}.yaml`.
- [ ] OIDC/Keycloak wiring is emitted into `values.managed.yaml` as secret references (no literal secrets in value files).
- [ ] `argocd`'s migration keeps the root app-of-apps functioning.
- [ ] Legacy `env/apps/.yaml` entries and inline-values path removed for this batch.
- [ ] Existing `installed:` gating still works from `env/settings/apps.yaml`.

## Blocked by

- linode/apl-core#3571
- linode/apl-core#3572
- linode/apl-core#3573

Start with the parent issue and blocked issues, then compare env/settings/apps.yaml and the existing env/apps/.yaml entries for keycloak, oauth2-proxy, argocd, and otomi-console. Trace the env/values///{custom,managed}.yaml files and generated Application CRs, paying special attention to argocd's root app-of-apps. Done means all four reconcile Healthy, OIDC values contain only Secret references, installed gating remains functional, and legacy entries are removed.

Written by the indexing model from the issue text.