feat(authentik): import 24 resources to TF; chore(bootstrap): add cilium to TF

Import all live authentik resources (groups, users, oauth2 providers, applications)
into terraform state via authentik-generated.tf. Provider config in authentik-config.tf.
Resources are drift-free and match live cluster.

Add cilium CNI to bootstrap helm_release.for_each (1.19.5, kube-system).
Cilium was unmanaged (helmfile-only); now IaC-owned. Critical path for
cluster rebuild recovery. Adds cilium repo to helm-repositories.tf.

terraform/bootstrap-releases.tf

@@ -5,6 +5,11 @@ locals {
       namespace     = "cert-manager"
       repo          = "jetstack"
     }
+    cilium = {
+      chart_version = "1.19.5"
+      namespace     = "kube-system"
+      repo          = "cilium"
+    }
     reloader = {
       chart_version = "1.3.0"
       namespace     = "reloader"