Merge branch 'main' into fix/pg-backup-mc-config

The backup CronJob runs as uid 65532 (runAsNonRoot). mc defaulted its
config dir to $HOME/.mc = /.mc and failed with "mkdir /.mc: permission
denied" on the non-writable root fs — every nightly run died before
uploading, so there are currently no backups in s3://drops/_pgbackups/.
Point MC_CONFIG_DIR at the shared /work emptyDir (writable via fsGroup).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/overlays/upc-dev/forte-drop-postgresql/resources/pg-backup-cronjob.yaml

@@ -77,6 +77,12 @@ spec:
               mc rm --recursive --force --older-than 30d "obj/${S3_BUCKET}/_pgbackups/" || true
               echo "backup retention pass complete"
             env:
+            # mc writes its config under $MC_CONFIG_DIR; point it at the shared
+            # emptyDir (writable by uid 65532 via fsGroup). Without this it tries
+            # to mkdir /.mc on the read-only-to-nonroot root fs -> "mkdir /.mc:
+            # permission denied" and every run fails before uploading.
+            - name: MC_CONFIG_DIR
+              value: "/work/.mc"
             - name: S3_ENDPOINT
               valueFrom:
                 secretKeyRef: { name: forte-drop-secrets, key: S3_ENDPOINT }

cluster-resources/policies/auth-sidecar-injector.yaml

@@ -235,8 +235,6 @@ spec:
               value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-scopes\" || 'openid,profile,email'  }}"
             - name: AUTH_OIDC_COOKIE_DOMAIN
               value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-cookie-domain\" || '' }}"
-            - name: AUTH_OIDC_ALLOWED_RETURN_HOSTS
-              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-allowed-return-hosts\" || '' }}"
             - name: AUTH_PUBLIC_PATHS
               value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-public-paths\" || '/healthz' }}"
             - name: AUTH_OIDC_COOKIE_SECRET

infra/values/base/gitea-values.yaml

@@ -31,7 +31,7 @@ gitea:
       ENABLE_PASSWORD_SIGNIN_FORM: false
       AUTO_WATCH_ON_CHANGES: false
       AUTO_WATCH_NEW_REPOS: false
-      ENABLE_NOTIFY_MAIL: true
+      ENABLE_NOTIFY_MAIL: false
       ENABLE_TIMETRACKING: false
 
     openid: