feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring

Adds permissions claim + per-service admin groups in Authentik, scoped
Role/RoleBinding per service, public PKCE kubernetes OAuth2 client, and
kube-apiserver OIDC extraArgs. Also fixes paperless OIDC signup permissions
via adapter override and adds CoreDNS rewrite for authentik.riotpiao.com.

k8s/infra/rbac/kustomization.yaml

@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# NO top-level `namespace:` transformer - each Role/RoleBinding here targets
+# a different service namespace (logging/storage/cicd/dashboard/sqs/temporal/
+# llm-serving); a transformer would collapse them all into one, same bug
+# already fixed once in k8s/infra/minio and k8s/infra/iam. Every resource
+# here sets its own explicit metadata.namespace.
+resources:
+  - grafana-operator-role.yaml
+  - minio-operator-role.yaml
+  - forgejo-operator-role.yaml
+  - homarr-operator-role.yaml
+  - portainer-operator-role.yaml
+  - kmsvc-operator-role.yaml
+  - temporal-operator-role.yaml
+  - llm-serving-operator-role.yaml
+# paperless's Role/RoleBinding lives in k8s/apps/paperless/rbac.yaml instead -
+# that app already has its own kustomization + namespace, no need to
+# duplicate it here. All of these stay inert (grant nothing) until
+# kube-apiserver has --oidc-groups-claim=groups wired up.