feat: add OIDC group binding for cluster-admin access

- Binds oidc:homelab-admins group to cluster-admin ClusterRole
- Allows OIDC users (via Authentik) to have admin access
- Groups claim from Authentik with oidc: prefix per kube-apiserver config
- Enables kubectl access via 'kubectl login' + kubelogin

k8s/infra/rbac/admin-oidc-binding.yaml

@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: homelab-admin-oidc
+spec:
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: ClusterRole
+    name: cluster-admin
+  subjects:
+    # OIDC group for Authentik homelab-admins members
+    # When rock logs in via OIDC, k8s sees:
+    # - User: oidc:[email protected]
+    # - Groups: oidc:homelab-admins (from Authentik group claim)
+    - kind: Group
+      name: oidc:homelab-admins