refactor(iam): extract provision python to scripts/authentik-provision.py + fix app-list idempotency — configMapGenerator (stable name) replaces inline script; superuser_full_list=true stops the 400 that aborted grant_types patching

k8s/security/iam/kustomization.yaml

@@ -14,6 +14,20 @@ kind: Kustomization
 resources:
   - key-rotation-cronjob.yaml
   - authentik-provision-job.yaml
+
+# Provisioning/verification python lives in scripts/*.py (real files, linted +
+# diff-friendly) and is generated into ConfigMaps here rather than embedded in
+# the job YAML. disableNameSuffixHash keeps the names stable so the Jobs'
+# configMap volume refs and PostSync hook-delete semantics keep working; each
+# hook Job is recreated per sync so it always mounts the latest script.
+configMapGenerator:
+  - name: authentik-provision-script
+    namespace: iam
+    files:
+      - authentik-provision.py=scripts/authentik-provision.py
+
+generatorOptions:
+  disableNameSuffixHash: true
 # authentik-migrations-job.yaml removed — redundant + broken. The authentik
 # `server` entrypoint runs migrations itself; this standalone job lacked the
 # authentik-secrets envFrom (Secret key missing) and always failed.