Jellyfin SSO: cheeztv OIDC hosts, media-group gating, LDAP outpost

Completes the Authentik-side plumbing for Jellyfin SSO across both media
instances -- fafflix (adults, jellyfin.k8s.syd1.au.unkin.net) and cheeztv
(kids, cheeztv.unkin.net + cheeztv.k8s.syd1.au.unkin.net) -- and adds an
LDAP outpost so native clients can authenticate with app passwords.

Why: the previously-merged jellyfin OIDC provider only covered the fafflix
host and gated on the generic jellyfin permission groups. cheeztv needs SSO
too, access should be limited to media users, and native (non-browser)
clients need a password-based path.

How:
- providers_oauth2/jellyfin.yaml: one shared confidential client now lists
  strict redirect URIs for all three hosts using the verified
  jellyfin-plugin-sso callback path /sso/OID/redirect/authentik. Client
  secret moved to kv kubernetes/namespace/fafflix/default/oauth-credentials.
- Access is gated to media users only: akP-media-fafflix and akP-media-cheeztv
  now carry `application: jellyfin` and bind to the app; akP-jellyfin-admin /
  akP-jellyfin-user are demoted to pure role-claim groups (no app binding),
  still mapped by the plugin for admin/user rights. Per-instance authz
  (adults -> both, kids -> cheeztv only) stays with the media proxy.
- providers_ldap/jellyfin-ldap.yaml: new LDAP provider (base_dn
  DC=ldap,DC=goauthentik,DC=io, direct bind/search) + application
  (jellyfin-ldap) + outpost (jellyfin-ldap-outpost) via the existing module.
- modules/authentik/main.tf: resolve LDAP bind/unbind flow slugs to ids via
  data.authentik_flow, matching the oauth2/saml convention.

config/permissions/akP-jellyfin-admin.yaml

@@ -1,3 +1,6 @@
-# Permission group akP-jellyfin-admin (name = filename). Grants admin
-# access to jellyfin: bound to the jellyfin application and mapped to its admin role.
-application: jellyfin
+# Permission group akP-jellyfin-admin (name = filename). Does NOT gate the
+# jellyfin application (SSO access is gated by the media groups akP-media-fafflix
+# / akP-media-cheeztv). It exists purely as an admin role-claim group: the
+# jellyfin-plugin-sso matches the hierarchical `ak_groups` claim against this
+# group name to grant Jellyfin administrator rights. Nested under akR-global-admin.
+attributes: {}

config/permissions/akP-jellyfin-user.yaml

@@ -1,3 +1,6 @@
-# Permission group akP-jellyfin-user (name = filename). Grants user
-# access to jellyfin: bound to the jellyfin application and mapped to its user role.
-application: jellyfin
+# Permission group akP-jellyfin-user (name = filename). Does NOT gate the
+# jellyfin application (SSO access is gated by the media groups akP-media-fafflix
+# / akP-media-cheeztv). It exists purely as a user role-claim group: the
+# jellyfin-plugin-sso matches the hierarchical `ak_groups` claim against this
+# group name for regular (non-admin) Jellyfin access. Nested under akR-standard-user.
+attributes: {}

config/permissions/akP-media-cheeztv.yaml

@@ -1,6 +1,6 @@
 # Permission group akP-media-cheeztv (name = filename). Per-service entitlement
-# for the kids ("cheeztv") media tier: NOT bound to any application (no
-# `application` field), so it does not gate OIDC. It exists purely to appear in
-# the user's hierarchical `ak_groups` claim, which the media proxy reads to
-# decide whether to route/authorize the cheeztv backend.
-attributes: {}
+# for the kids ("cheeztv") media tier. Bound to the jellyfin application, so it
+# gates Jellyfin SSO access: only members (via akR-media-adult or akR-media-kids)
+# may authorize. It also appears in the user's hierarchical `ak_groups` claim,
+# which the media proxy reads to route/authorize the cheeztv backend.
+application: jellyfin

config/permissions/akP-media-fafflix.yaml

@@ -1,6 +1,6 @@
 # Permission group akP-media-fafflix (name = filename). Per-service entitlement
-# for the adult ("fafflix") media tier: NOT bound to any application (no
-# `application` field), so it does not gate OIDC. It exists purely to appear in
-# the user's hierarchical `ak_groups` claim, which the media proxy reads to
-# decide whether to route/authorize the fafflix backend.
-attributes: {}
+# for the adult ("fafflix") media tier. Bound to the jellyfin application, so it
+# gates Jellyfin SSO access: only members (via akR-media-adult) may authorize.
+# It also appears in the user's hierarchical `ak_groups` claim, which the media
+# proxy reads to route/authorize the fafflix backend.
+application: jellyfin