Wire Grafana OAuth roles to Authentik ak_groups / akP-grafana-admin

Consume the two-tier Authentik RBAC (terraform-authentik): request the
hierarchical `ak_groups` scope and map `akP-grafana-admin` to the Grafana Admin
role (replacing the flat `grafana-admins`). Members of akR-global-admin inherit
akP-grafana-admin. Everyone else who can log in (gated to akP-grafana-* by the
Authentik access policy) gets Viewer.

apps/base/grafana/grafana.yaml

@@ -51,10 +51,13 @@ spec:
       allow_sign_up: "true"
       use_pkce: "true"
       client_id: "grafana"
-      scopes: "openid email profile"
+      # ak_groups = hierarchical group claim from terraform-authentik (carries
+      # permission groups inherited via role groups).
+      scopes: "openid email profile ak_groups"
       auth_url: "https://identity.unkin.net/application/o/authorize/"
       token_url: "https://identity.unkin.net/application/o/token/"
       api_url: "https://identity.unkin.net/application/o/userinfo/"
-      # Authentik groups -> Grafana roles (adjust group name as needed).
-      role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'"
+      # Authentik permission groups -> Grafana roles. akP-grafana-admin is granted
+      # to akR-global-admin members (and direct members) via terraform-authentik.
+      role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'"
       role_attribute_strict: "false"