feat: add homelab-wide Authentik RBAC model and k8s OIDC auth wiring

Adds permissions claim + per-service admin groups in Authentik, scoped
Role/RoleBinding per service, public PKCE kubernetes OAuth2 client, and
kube-apiserver OIDC extraArgs. Also fixes paperless OIDC signup permissions
via adapter override and adds CoreDNS rewrite for authentik.riotpiao.com.

terraform/templates/controlplane.tftpl

@@ -33,6 +33,14 @@ machine:
       - ip: ${forgejo_registry_ip}
         aliases:
           - ${forgejo_hostname}
+      # kube-apiserver's static pod runs on the host network, so it resolves
+      # authentik.riotpiao.com via THIS node's DNS, not cluster CoreDNS - the
+      # OIDC issuer discovery call would otherwise hit the public
+      # Cloudflare-fronted IP instead of nginx directly. Same reasoning as
+      # the forgejo entry above.
+      - ip: 192.168.1.160
+        aliases:
+          - authentik.riotpiao.com
   kubelet:
     image: ${kubelet_image}
     defaultRuntimeSeccompProfileEnabled: true
@@ -120,6 +128,19 @@ cluster:
       - ${san}
 %{ endfor ~}
     image: ${kube_apiserver_img}
+    # Foundation for the Authentik group -> k8s RBAC pattern in
+    # k8s/infra/rbac/ - additive only, existing client-cert auth
+    # (system:masters, this session's own admin@homelab-cluster kubeconfig)
+    # keeps working unchanged; a bad OIDC config just means OIDC logins fail,
+    # not a lockout. Prefixes avoid collision with built-in system:* users
+    # and groups.
+    extraArgs:
+      oidc-issuer-url: https://authentik.riotpiao.com/application/o/kubernetes/
+      oidc-client-id: kubernetes
+      oidc-username-claim: email
+      oidc-groups-claim: groups
+      oidc-username-prefix: "oidc:"
+      oidc-groups-prefix: "oidc:"
     admissionControl:
       - name: PodSecurity
         configuration: