fix(argocd): reference argocd-oidc-secret directly for OIDC (DEV-523)

Post-migration verify uncovered that Pocket ID OIDC login was broken:
the argocd-server was rendering $oidc.pocketid.clientId literally into
the authorize URL instead of substituting the client id.

The Helm chart's default $key syntax looks in argocd-secret, but our
OIDC keys are held only in the SealedSecret-backed argocd-oidc-secret
Opaque secret. Pre-migration argocd-secret happened to contain byte-for-
byte copies of those keys (legacy install), which is why it worked.

Switch to Argo CD's $secret:key form so the values point at the correct
secret without duplicating sealed material into argocd-secret.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/argocd/values.yaml

@@ -16,8 +16,8 @@ configs:
     oidc.config: |
       name: Pocket ID
       issuer: https://auth.basicstack.de
-      clientID: $oidc.pocketid.clientId
+      clientID: $argocd-oidc-secret:oidc.pocketid.clientId
-      clientSecret: $oidc.pocketid.clientSecret
+      clientSecret: $argocd-oidc-secret:oidc.pocketid.clientSecret
       requestedScopes: [openid, profile, email, groups]
       requestedIDTokenClaims:
         groups: {essential: true}