iam: move provisioning script to scripts/iam, remove k8s job

- Move authentik-provision.py to scripts/iam/ (manual-only)
- Remove job/RBAC resources (not needed for local runs)
- Use public URL directly (no sed substitution needed)
- Add app password support via set_key endpoint
- Support both password grant and client_credentials

k8s/infra/iam/kustomization.yaml

@@ -1,35 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-# NOTE: no top-level `namespace:` transformer here (removed) - it used to
-# force-rewrite metadata.namespace to "iam" on every resource in this
-# kustomization, which was harmless while every manifest here only ever
-# targeted the iam namespace itself. authentik-provision-job.yaml's
-# RoleBindings deliberately target cicd/argocd/logging/storage (least-
-# privilege access for the authentik-provisioner ServiceAccount to touch
-# Secrets in those namespaces) - the namespace transformer would have
-# silently rewritten all of them back to iam, breaking the RBAC. Every
-# manifest in this directory already sets its own explicit
-# metadata.namespace, so dropping the transformer changes nothing for the
-# existing resources/.
+
 resources:
-  - authentik-provision-job.yaml
   - rbac-dashboard-rolebinding.yaml
 
-# Provisioning/verification python lives in scripts/*.py (real files, linted +
-# diff-friendly) and is generated into ConfigMaps here rather than embedded in
-# the job YAML. disableNameSuffixHash keeps the names stable so the Jobs'
-# configMap volume refs and PostSync hook-delete semantics keep working; each
-# hook Job is recreated per sync so it always mounts the latest script.
-configMapGenerator:
-  - name: authentik-provision-script
-    namespace: iam
-    files:
-      - authentik-provision.py=scripts/authentik-provision.py
-
-generatorOptions:
-  disableNameSuffixHash: true
-# authentik-migrations-job.yaml removed — redundant + broken. The authentik
-# `server` entrypoint runs migrations itself; this standalone job lacked the
-# authentik-secrets envFrom (Secret key missing) and always failed.
-# SOPS secrets (*.enc.yaml) handled by ArgoCD SOPS plugin at sync time
-# authentik/vault deployed via ArgoCD Helm source
+# IAM provisioning is manual-only (security-sensitive).
+# Script: scripts/iam/authentik-provision.py
+# Run:
+#   export AUTHENTIK_BOOTSTRAP_TOKEN=$(kubectl -n iam get secret authentik-secrets \
+#     -o jsonpath='{.data.AUTHENTIK_BOOTSTRAP_TOKEN}' | base64 -d)
+#   python3 scripts/iam/authentik-provision.py