Onboard OpenBao as an Authentik OIDC client

Adds config/providers_oauth2/vault.yaml so human logins to OpenBao go
through Authentik SSO (bao CLI and the web UI). Machine auth (approle,
kubernetes, CI) and break-glass are unchanged and stay on the OpenBao side.

Extends the oauth2 provider module so a config may generate its own client
secret instead of reading a pre-seeded one: client_secret_vault.generate
creates a random_password and writes {client_id, client_secret} to the given
kv-v2 path. Providers without the flag keep the existing read-only data source
behaviour. This is what lets the provider land with no manual Vault seed.

Gates the new application with akP-vault-admin and nests it in
akR-global-admin, matching how every other app in this repo is bound.

modules/authentik/variables.tf

@@ -60,9 +60,13 @@ variable "providers_oauth2" {
     client_id          = string
     # client_secret is never committed. Point at a Vault kv-v2 secret whose
     # `client_secret` key holds the value (seeded out of band); TF reads it.
+    # generate = true flips that around: the secret is created here and written
+    # to that path as {client_id, client_secret}, so onboarding needs no manual
+    # seed. Requires write access to the kv path.
     client_secret_vault = optional(object({
-      mount = string
-      path  = string
+      mount    = string
+      path     = string
+      generate = optional(bool, false)
     }), null)
     # Managed identifiers of scope property mappings (e.g.
     # goauthentik.io/providers/oauth2/scope-openid). Resolved to ids.