fix(authentik): drop redundant authentik-migrate init container — server entrypoint migrates; old-image manage migrate tripped version-history precheck on empty DB

k8s/security/iam/authentik-values.yaml

@@ -82,21 +82,10 @@ _caInitContainers: &caInitContainers
         readOnly: true
       - name: merged-ca
         mountPath: /merged
-  - name: authentik-migrate
-    image: ghcr.io/goauthentik/server:2026.5.4
-    imagePullPolicy: IfNotPresent
-    command:
-      - sh
-      - -c
-      - python -m manage migrate --noinput
-    envFrom:
-      - secretRef:
-          name: authentik
-      # SOPS-CMP-emitted secret values (SECRET_KEY, PG password, bootstrap creds)
-      # merged after the chart config secret — see sops-cmp-plugin.yaml.
-      - secretRef:
-          name: authentik-secrets
-    volumeMounts: *caVolumeMounts
+  # NOTE: no authentik-migrate init container — the authentik `server` entrypoint
+  # runs migrations itself on startup. A separate `manage migrate` init pinned to
+  # an older image tripped a version-history precheck on an empty DB
+  # (relation "authentik_version_history" does not exist) and blocked boot.
 
 _caEnv: &caEnv
   - name: REQUESTS_CA_BUNDLE