Fix mediamark Vault secret path and permission group name

The terraform-authentik runner's Vault policy only grants read on
kv/data/kubernetes/namespace/+/default/oauth-credentials (literal trailing
filename), so the arrstack/default/mediamark-oauth-credentials path 403s at
plan time and reddens CI. mediamark deploys in its own `mediamark` namespace
(watchstate model), so point the data source at
kubernetes/namespace/mediamark/default/oauth-credentials, which the policy
covers. Hostnames are unchanged.

Rename the permission group to akP-mediamark-user to match the peer tier-suffix
convention (akP-watchstate-admin, akP-arrstack-user). The group name is derived
from the filename in config/config.hcl, so update the akR-media-adult
reference too.

config/roles/akR-media-adult.yaml

@@ -3,9 +3,9 @@
 # per-service entitlements. Membership propagates child -> parent, so a member
 # appears in both permission groups in the hierarchical `ak_groups` claim and the
 # media proxy routes/authorizes them for fafflix and cheeztv. Adults also curate
-# which titles are kids content, so the role nests akP-mediamark for access to
-# the mediamark UI.
+# which titles are kids content, so the role nests akP-mediamark-user for access
+# to the mediamark UI.
 permissions:
   - akP-media-fafflix
   - akP-media-cheeztv
-  - akP-mediamark
+  - akP-mediamark-user