chore(deps): update terraform azurerm to v5

.gitea/workflows/ai-review.yaml

@@ -41,11 +41,11 @@ jobs:
       run: git submodule update --remote --merge
 
     - name: Run inline review
-      uses: docker://nikitafilonov/ai-review:v1.1.0
+      uses: docker://nikitafilonov/ai-review:v0.77.0
       with:
         args: ai-review run-inline
 
     - name: Run summary review
-      uses: docker://nikitafilonov/ai-review:v1.1.0
+      uses: docker://nikitafilonov/ai-review:v0.77.0
       with:
         args: ai-review run-summary

cluster-resources/gitea-backup-cronjob.yaml

@@ -29,7 +29,7 @@ spec:
                   topologyKey: kubernetes.io/hostname
           initContainers:
             - name: gitea-dump
-              image: gitea/gitea:28.0.0
+              image: gitea/gitea:1.27.3
               command:
                 - sh
                 - -c

docs/DEVELOPER-GUIDE.md

@@ -1469,12 +1469,6 @@ ArgoCD will sync the Keycloak config, and the registrar CronJob will pick up the
 | `k8s.secret.client-id-key` | No | `client-id` | Field name for the client ID in the K8s Secret |
 | `k8s.secret.client-secret-key` | No | `client-secret` | Field name for the client secret in the K8s Secret |
 
-#### Public CLI Client (Device-Code Login)
-
-`forte-cli` is a shared **public** client (no secret) with the RFC 8628 device-authorization grant enabled (`oauth2.device.authorization.grant.enabled: "true"`, `standardFlowEnabled: false`, `directAccessGrantsEnabled: false`). Downloaded skills and CLI tools that log in through the Auth Sidecar (forte-drop first) use it with `<PREFIX>_CLIENT_ID=forte-cli`; nothing per-tool needs to be registered in Keycloak.
-
-It must be defined in `forte-realm.json` (this legacy path): the self-service registrar hardcodes `publicClient: false` / `standardFlowEnabled: true` and drops `attributes`, so a `client-config` Secret cannot produce a public device-code client. It carries no `k8s.secret.sync` attribute (the registrar's secret sync skips it) and is listed in the cleanup CronJob's protected clients.
-
 ### Retrieving Secrets for External Deployments
 
 The registrar always writes a **central copy** of every synced secret to the `secrets` namespace, in addition to the target namespace. This allows operators to retrieve client credentials for applications deployed outside this cluster:

infra/base/fluent-bit/fluent-bit.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://fluent.github.io/helm-charts
     chart: fluent-bit
-    targetRevision: 0.58.3
+    targetRevision: 0.58.2
     helm:
       releaseName: fluent-bit
       valueFiles:

infra/base/traefik-application/traefik-application.yaml

@@ -24,7 +24,7 @@ spec:
   sources:
   - repoURL: https://traefik.github.io/charts
     chart: traefik
-    targetRevision: "41.6.0"
+    targetRevision: "28.3.0"
     helm:
       releaseName: traefik
       valueFiles:

infra/values/base/keycloak-values.yaml

@@ -186,35 +186,6 @@ keycloakConfigCli:
                 }
               }
             ]
-          },
-          {
-            "clientId": "forte-cli",
-            "name": "Forte CLI",
-            "description": "Shared public client for RFC 8628 device-code login from downloaded skills/CLI tools (forte-drop first) against services behind Auth Sidecar. No client secret.",
-            "enabled": true,
-            "protocol": "openid-connect",
-            "standardFlowEnabled": false,
-            "directAccessGrantsEnabled": false,
-            "publicClient": true,
-            "redirectUris": [],
-            "webOrigins": [],
-            "attributes": {
-              "oauth2.device.authorization.grant.enabled": "true"
-            },
-            "protocolMappers": [
-              {
-                "name": "audience-forte-drop-mcp",
-                "protocol": "openid-connect",
-                "protocolMapper": "oidc-audience-mapper",
-                "consentRequired": false,
-                "config": {
-                  "included.custom.audience": "https://mcp.drop.forteapps.net/mcp",
-                  "access.token.claim": "true",
-                  "id.token.claim": "false",
-                  "introspection.token.claim": "true"
-                }
-              }
-            ]
           }
         ],
         "browserFlow": "browser-auto-idp",
@@ -700,7 +671,7 @@ extraDeploy:
                 MIN_AGE_SEC=$((MIN_AGE_DAYS * 86400))
 
                 # Hardcoded protected clients (never delete these)
-                PROTECTED_JSON='["gitea","grafana","argocd","forte-cli","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
+                PROTECTED_JSON='["gitea","grafana","argocd","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
 
                 echo "Fetching clients from realm '${REALM}'..."
                 CLIENTS=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \