Add two-tier RBAC: permission/role groups, access policies, group claim

Introduce a user -> role -> [permissions] model for app access and roles,
managed declaratively.

- Permission groups (akP-<app>-<access>) under config/permissions/: atomic units,
  each names the application it grants access to.
- Role groups (akR-<role>) under config/roles/: what users are assigned to;
  each nests permission groups via parents (akR-global-admin -> all *-admin,
  akR-standard-user -> all *-user). Split into a separate authentik_group
  resource so roles can reference permission ids without self-reference.
- Policy bindings gate each application to its permission groups (and, via
  child->parent membership propagation, the roles that nest them).
- Hierarchical `groups` scope mapping: walks user groups up through .parents so
  the OIDC claim includes inherited permission groups (works around
  goauthentik/authentik#15579). Inert until a provider requests the `groups`
  scope, so no behaviour change to existing apps until they opt in.

Validated with `tofu validate`.

config/config.hcl

@@ -12,6 +12,16 @@ locals {
       trimsuffix(basename(file_path), ".yaml") => content
       if startswith(file_path, "groups/")
     }
+    permission_groups = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "permissions/")
+    }
+    role_groups = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "roles/")
+    }
     providers_saml = {
       for file_path, content in local.all_configs :
       trimsuffix(basename(file_path), ".yaml") => content

config/permissions/ak-p-argocd-admin.yaml

@@ -0,0 +1,4 @@
+# Permission: admin access to argocd. Bound to the argocd application for
+# access, and mapped to the argocd admin role via the groups claim.
+name: akP-argocd-admin
+application: argocd

config/permissions/ak-p-argocd-user.yaml

@@ -0,0 +1,4 @@
+# Permission: user access to argocd. Bound to the argocd application for
+# access, and mapped to the argocd user role via the groups claim.
+name: akP-argocd-user
+application: argocd

config/permissions/ak-p-grafana-admin.yaml

@@ -0,0 +1,4 @@
+# Permission: admin access to grafana. Bound to the grafana application for
+# access, and mapped to the grafana admin role via the groups claim.
+name: akP-grafana-admin
+application: grafana

config/permissions/ak-p-grafana-user.yaml

@@ -0,0 +1,4 @@
+# Permission: user access to grafana. Bound to the grafana application for
+# access, and mapped to the grafana user role via the groups claim.
+name: akP-grafana-user
+application: grafana

config/permissions/ak-p-rancher-admin.yaml

@@ -0,0 +1,4 @@
+# Permission: admin access to rancher. Bound to the rancher application for
+# access, and mapped to the rancher admin role via the groups claim.
+name: akP-rancher-admin
+application: rancher

config/permissions/ak-p-rancher-user.yaml

@@ -0,0 +1,4 @@
+# Permission: user access to rancher. Bound to the rancher application for
+# access, and mapped to the rancher user role via the groups claim.
+name: akP-rancher-user
+application: rancher

config/roles/ak-r-global-admin.yaml

@@ -0,0 +1,7 @@
+# Role: full admin across all onboarded apps. Assign users here for org-wide admin.
+name: akR-global-admin
+is_superuser: false
+permissions:
+  - ak-p-grafana-admin
+  - ak-p-argocd-admin
+  - ak-p-rancher-admin

config/roles/ak-r-standard-user.yaml

@@ -0,0 +1,6 @@
+# Role: standard (non-admin) access across all onboarded apps.
+name: akR-standard-user
+permissions:
+  - ak-p-grafana-user
+  - ak-p-argocd-user
+  - ak-p-rancher-user