feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring

Adds permissions claim + per-service admin groups in Authentik, scoped
Role/RoleBinding per service, public PKCE kubernetes OAuth2 client, and
kube-apiserver OIDC extraArgs. Also fixes paperless OIDC signup permissions
via adapter override and adds CoreDNS rewrite for authentik.riotpiao.com.

k8s/argocd/apps/60-applications.yaml

@@ -203,3 +203,28 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+---
+# Wave 9 - per-service scoped RBAC (Role/RoleBinding), deliberately last so
+# every target namespace above already exists. Inert until kube-apiserver
+# gets --oidc-groups-claim=groups wired up (separate, not-yet-applied
+# terraform/talosctl change) - these grant nothing until then.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: rbac
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "9"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
+    targetRevision: main
+    path: k8s/infra/rbac
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true