fix: use explicit-consent flow for kubernetes public OIDC client

- Kubernetes provider now uses default-provider-authorization-explicit-consent
  instead of implicit-consent flow
- Better handling for public clients like kubelogin (authcode grant)
- Prevents fallback to password grant prompts

scripts/iam/authentik-provision.py

@@ -716,6 +716,10 @@ for name, cfg in SERVICES.items():
 # Redirect URI matches kubelogin's (int128/kubelogin) documented default;
 # adjust here if a different kubectl OIDC plugin/port is actually used.
 print("Ensuring public OAuth2 client 'kubernetes' for kubectl OIDC login...")
+# Fetch explicit-consent flow for public authcode clients (kubelogin)
+status, res = api("GET", "/api/v3/flows/instances/?slug=default-provider-authorization-explicit-consent")
+k8s_authz_flow = res["results"][0]["pk"] if res["results"] else AUTHORIZATION_FLOW_PK
+
 k8s_provider = get_or_create(
     "/api/v3/providers/oauth2/", "/api/v3/providers/oauth2/",
     "name=kubernetes",
@@ -723,7 +727,7 @@ k8s_provider = get_or_create(
         "name": "kubernetes",
         "client_id": "kubernetes",
         "client_type": "public",
-        "authorization_flow": AUTHORIZATION_FLOW_PK,
+        "authorization_flow": k8s_authz_flow,
         "invalidation_flow": INVALIDATION_FLOW_PK,
         "signing_key": SIGNING_KEY_PK,
         "property_mappings": SCOPE_PKS,