web-app-minio: enable OIDC integration and policy handling

- Added OIDC and LDAP feature flags in config
- Introduced API/Console URL vars for proxy alignment
- Implemented automatic MinIO policy creation for OIDC admin group
- Replaced static env.J2 with dynamic env.j2 (OIDC-aware)
- Added policy.json.j2 template with full admin rights
- Cleaned up tasks to use stdin instead of file for mc policy apply

Ref: https://chatgpt.com/share/68d1d3ef-ca84-800f-abe2-11ab70e20c4e

roles/web-app-minio/tasks/main.yml

@@ -23,3 +23,18 @@
   loop: "{{ MINIO_FRONT_PROXY_MATRIX }}"
   loop_control:
     label: "{{ item.domain }} -> {{ item.http_port }}"
+
+- block:
+    - name: "Render MinIO policy into variable"
+      set_fact:
+        minio_policy_content: "{{ lookup('template', 'policy.json.j2') }}"
+
+    - name: "Apply MinIO policy {{ MINIO_OIDC_POLICY_NAME }}"
+      shell: |
+        set -euo pipefail
+        mc alias set minio {{ MINIO_API_URL }} {{ users.administrator.username }} {{ users.administrator.password }}
+        mc admin policy create minio {{ MINIO_OIDC_POLICY_NAME }} /dev/stdin || true
+      args:
+        executable: /bin/bash
+        stdin: "{{ minio_policy_content }}"
+  when: MINIO_OIDC_ENABLED | bool