1d4bf9de87
Consume the two-tier Authentik RBAC (terraform-authentik): request the hierarchical `ak_groups` scope and map `akP-grafana-admin` to the Grafana Admin role (replacing the flat `grafana-admins`). Members of akR-global-admin inherit akP-grafana-admin. Everyone else who can log in (gated to akP-grafana-* by the Authentik access policy) gets Viewer.