OpenCloud: Remove client secrets for public SPA with PKCE

OpenCloud's web frontend is a public Single Page Application that uses
PKCE (Proof Key for Code Exchange) and does not need client secrets.

Removed:
- OC_OIDC_CLIENT_SECRET
- WEB_OIDC_CLIENT_SECRET

The Pocket ID OIDC client must be configured as:
- Public Client: Enabled
- PKCE: Enabled
- Callback URLs:
  - https://opencloud.basicstack.de/
  - https://opencloud.basicstack.de/oidc-callback.html
  - https://opencloud.basicstack.de/oidc-silent-redirect.html
- Logout URL: https://opencloud.basicstack.de

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/opencloud/opencloud-deployment.yaml

@@ -160,11 +160,7 @@ spec:
             secretKeyRef:
               name: opencloud-oidc-secret
               key: oidc-client-id
-        #- name: OC_OIDC_CLIENT_SECRET
-        #  valueFrom:
-        #    secretKeyRef:
-        #      name: opencloud-oidc-secret
-        #      key: oidc-client-secret
+        # No OC_OIDC_CLIENT_SECRET - OpenCloud web frontend is a public SPA using PKCE
         - name: OC_OIDC_CLIENT_SCOPES
           value: "openid profile email groups"
 
@@ -204,12 +200,13 @@ spec:
         - name: IDM_CREATE_DEMO_USERS
           value: "false"
 
-        # Web service OIDC configuration
+        # Web service OIDC configuration (Public Client with PKCE)
         - name: WEB_OIDC_CLIENT_ID
           valueFrom:
             secretKeyRef:
               name: opencloud-oidc-secret
               key: oidc-client-id
+        # No WEB_OIDC_CLIENT_SECRET - web frontend is a public SPA using PKCE
         - name: WEB_OIDC_AUTHORITY
           value: "https://auth.basicstack.de"
         - name: WEB_OIDC_METADATA_URL