feat(authentik): import 24 resources to TF; chore(bootstrap): add cilium to TF

Import all live authentik resources (groups, users, oauth2 providers, applications)
into terraform state via authentik-generated.tf. Provider config in authentik-config.tf.
Resources are drift-free and match live cluster.

Add cilium CNI to bootstrap helm_release.for_each (1.19.5, kube-system).
Cilium was unmanaged (helmfile-only); now IaC-owned. Critical path for
cluster rebuild recovery. Adds cilium repo to helm-repositories.tf.

terraform/helm-repositories.tf

@@ -4,6 +4,7 @@ locals {
     jetstack             = "https://charts.jetstack.io"
     stakater             = "https://stakater.github.io/stakater-charts"
     ingress_nginx        = "https://kubernetes.github.io/ingress-nginx"
+    cilium               = "https://helm.cilium.io"
     cnpg                 = "https://cloudnative-pg.github.io/charts"
     authentik            = "https://charts.goauthentik.io"
     hashicorp            = "https://helm.releases.hashicorp.com"