chore(deploy): set the PocketID client id

The redirect URI registered against this client must be
https://memory.cloud.traunseenet.com/ui/auth/callback — OidcClient derives it
from UI_BASE_URL, so the two move together.

secret.yaml (SOPS) is now the only thing standing between this overlay and a
clean render. The digest and client-id placeholder spellings stay on the test's
allowlist: the digest is bumped by hand on every build (§13a.2), so it comes
back each release.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0139vHnNpS2sLNELjrAHX5Cu

deploy/kubernetes/apps/apps/mdmem/mdmem/app/kustomization.yaml

@@ -46,7 +46,7 @@ configMapGenerator:
       - UI_ALLOWED_ORIGINS=https://memory.cloud.traunseenet.com
       - OIDC_ISSUER=https://pocketid.cloud.traunseenet.com
       - OIDC_SCOPE=openid email profile groups
-      - OIDC_CLIENT_ID=REPLACE-WITH-THE-POCKETID-CLIENT-UUID
+      - OIDC_CLIENT_ID=dc2aa40e-4386-46cc-bae6-0259a2e7490e
       - OIDC_GROUPS_CLAIM=groups
       - OIDC_REQUIRED_GROUP=mdmem_admins
       - SESSION_TTL_HOURS=12

tests/test_deploy.py

@@ -1,11 +1,14 @@
 """Smoke tests for the committed Kubernetes overlay (PLAN §13a).
 
-The overlay is not directly buildable — `secret.yaml` is SOPS-encrypted and kept out
-of the repo, and the image digest plus the PocketID client id are release-time
-placeholders. That is deliberate, but until now nothing checked that the rest of it
-stays coherent: a renamed environment variable, a probe that points at a port the
-container does not expose, or a resource dropped from the kustomization would only
-surface on a cluster.
+The overlay is not directly buildable: `secret.yaml` is SOPS-encrypted and kept out
+of the repo. The image digest and the PocketID client id are filled in, but both are
+release-time values — the digest is bumped by hand on every build (§13a.2) — so their
+placeholder spellings stay on the allowlist below rather than being treated as a
+defect if they reappear.
+
+Nothing else checked that the overlay stayed coherent: a renamed environment
+variable, a probe pointing at a port the container does not expose, or a resource
+dropped from the kustomization would only surface on a cluster.
 """
 
 from pathlib import Path