Wire ArgoCD RBAC to Authentik ak_groups / akP-argocd-admin

Consume the two-tier Authentik RBAC (terraform-authentik): request the
hierarchical `ak_groups` scope/claim and map the `akP-argocd-admin` permission
group to role:admin (replacing the flat `argocd-admins`). Members of
akR-global-admin inherit akP-argocd-admin, so they get ArgoCD admin.

- argocd-cm: add `ak_groups` to requestedScopes + requestedIDTokenClaims
- argocd-rbac-cm: scopes [ak_groups]; policy.csv g, akP-argocd-admin, role:admin

clusters/au-syd1/bootstrap/argocd-cm-patch.yaml

@@ -20,6 +20,9 @@ data:
       - openid
       - profile
       - email
+      # Hierarchical group claim from terraform-authentik (includes permission
+      # groups inherited via role groups). Read for RBAC below.
+      - ak_groups
     requestedIDTokenClaims:
-      groups:
+      ak_groups:
         essential: true

clusters/au-syd1/bootstrap/argocd-rbac-cm-patch.yaml

@@ -5,10 +5,12 @@ metadata:
   name: argocd-rbac-cm
   namespace: argocd
 data:
-  # Match RBAC subjects against the `groups` claim from Authentik.
-  scopes: "[groups]"
+  # Match RBAC subjects against the hierarchical `ak_groups` claim from Authentik
+  # (carries permission groups inherited via role groups).
+  scopes: "[ak_groups]"
   # Authenticated users with no matching group get read-only access.
   policy.default: role:readonly
-  # Authentik group -> ArgoCD role.
+  # Authentik permission group -> ArgoCD role. akP-argocd-admin is granted to
+  # akR-global-admin members (and direct members) via terraform-authentik.
   policy.csv: |
-    g, argocd-admins, role:admin
+    g, akP-argocd-admin, role:admin