feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring

Adds permissions claim + per-service admin groups in Authentik, scoped
Role/RoleBinding per service, public PKCE kubernetes OAuth2 client, and
kube-apiserver OIDC extraArgs. Also fixes paperless OIDC signup permissions
via adapter override and adds CoreDNS rewrite for authentik.riotpiao.com.

k8s/apps/paperless/deployment.yaml

@@ -82,6 +82,13 @@ spec:
               mountPath: /usr/src/paperless/data
             - name: consume
               mountPath: /usr/src/paperless/consume
+            # Overrides paperless-ngx's own adapter.py in place - settings.py
+            # hardcodes the import path, so no Django setting changes, just
+            # the file content underneath it (see adapter-configmap.yaml).
+            - name: adapter
+              mountPath: /usr/src/paperless/src/paperless/adapter.py
+              subPath: adapter.py
+              readOnly: true
       volumes:
         - name: media
           persistentVolumeClaim:
@@ -91,3 +98,6 @@ spec:
             claimName: paperless-data
         - name: consume
           emptyDir: {}
+        - name: adapter
+          configMap:
+            name: paperless-adapter