feat(authentik): import 24 resources to TF; chore(bootstrap): add cilium to TF

Import all live authentik resources (groups, users, oauth2 providers, applications)
into terraform state via authentik-generated.tf. Provider config in authentik-config.tf.
Resources are drift-free and match live cluster.

Add cilium CNI to bootstrap helm_release.for_each (1.19.5, kube-system).
Cilium was unmanaged (helmfile-only); now IaC-owned. Critical path for
cluster rebuild recovery. Adds cilium repo to helm-repositories.tf.

terraform/authentik-config.tf

@@ -0,0 +1,9 @@
+# Authentik provider — resources imported from live cluster.
+# Resource bodies generated via `terraform plan -generate-config-out`
+# into authentik-generated.tf. Import mappings in authentik-imports.tf.
+# Token: terraform.tfvars.local as authentik_api_token (sensitive).
+
+provider "authentik" {
+  url   = "https://authentik.${var.cluster_domain}"
+  token = var.authentik_api_token
+}