fix: core-cli OAuth2 + S3 backend + admin group

- Link core-cli app to OAuth2 provider (was hardcoded to 0)
- Add core-cli user to authentik_admins for CI access
- Fix terraform init: use 'endpoint' not 'endpoints.s3' for S3 backend
  (Terraform 1.9.4 compatibility, matches state.tf config)

.forgejo/workflows/terraform-apply.yml

@@ -80,8 +80,6 @@ jobs:
       - name: Terraform Init
         working-directory: terraform
         env:
-          # MinIO S3 backend — use internal DNS (storage ns) instead of external hostname
-          # Runner pod blocked from external DNS; internal DNS is routable
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           TF_VAR_kubeconfig_path: /tmp/kubeconfig
@@ -89,8 +87,8 @@ jobs:
           TF_SKIP_REGION_VALIDATION: "true"
           TF_SKIP_REQUESTING_ACCOUNT_ID: "true"
         run: |
-          # Override S3 endpoint to use internal cluster DNS
-          export TF_CLI_ARGS_init="-backend-config=endpoints.s3=http://minio.storage.svc.cluster.local:9000"
+          # Override S3 endpoint to use internal cluster DNS (storage ns)
+          export TF_CLI_ARGS_init="-backend-config=endpoint=http://minio.storage.svc.cluster.local:9000"
           terraform init
 
       - name: Pull Terraform State