fix: keep OAuth auth env declarative across restarts

[artiphishle]

Why

Studio ADM 5 full Infra E2E exposed a repeat-Infra Up failure for Supabase OAuth projects. The generated Auth Deployment canonically owns API_EXTERNAL_URL, GOTRUE_SITE_URL, GOTRUE_URI_ALLOW_LIST, and GOTRUE_JWT_ISSUER through configMapKeyRef, but OAuth reconciliation later replaced those entries with literal values via kubectl set env deployment/auth.

On the next Infra Up, kubectl apply attempted to restore valueFrom while the live Deployment still carried value, producing invalid Kubernetes env entries with both value and valueFrom.

Changes

• keep the Auth Deployment environment declarative; OAuth reconciliation no longer calls kubectl set env deployment/auth
• persist redirect metadata as before, then re-sync the canonical Supabase runtime ConfigMap/Secret sources
• restart GoTrue only after canonical runtime sources are synchronized
• add regression assertions that the affected Auth env entries remain valueFrom-backed and the generated up script never imperatively replaces them
• add a patch changeset

Validation context

The failure was reproduced by Studio's two-project Minikube/Supabase E2E on the second OAuth-project startup after credentials had been stored in Vault and trusted host resolution was intentionally unavailable. Initial project provisioning, Supabase migrations, Vault/OAuth setup, Studio web smoke, generated-app web E2E, and unit/static gates all completed before this restart-specific failure.

Roadmap context: ankhorage/studio#120