Add stalwart OIDC application and provider

- add config/providers_oauth2/stalwart.yaml reading its client_secret from kv/kubernetes/namespace/mail/stalwart/oauth-credentials
- add permission group akP-mail-users bound to the stalwart application
- nest akP-mail-users under akR-global-admin

config/permissions/akP-mail-users.yaml

@@ -0,0 +1,3 @@
+# Permission group akP-mail-users (name = filename). Grants mailbox access:
+# bound to the stalwart application, gating mail.unkin.net logins.
+application: stalwart

config/providers_oauth2/stalwart.yaml

@@ -0,0 +1,21 @@
+# OAuth2/OIDC provider + application for Stalwart (mail server, web UI/JMAP at
+# https://mail.unkin.net in the mail namespace). Stalwart's OIDC directory
+# validates access tokens (JWT, userinfo fallback) and requires aud=stalwart
+# plus the openid+email scopes; it maps preferred_username/name from profile.
+# client_secret is read from Vault (seeded out of band), never committed.
+name: stalwart
+authorization_flow: default-provider-authorization-implicit-consent
+invalidation_flow: default-provider-invalidation-flow
+client_type: confidential
+client_id: stalwart
+launch_url: https://mail.unkin.net/
+client_secret_vault:
+  mount: kv
+  path: kubernetes/namespace/mail/stalwart/oauth-credentials
+scope_mappings:
+  - goauthentik.io/providers/oauth2/scope-openid
+  - goauthentik.io/providers/oauth2/scope-email
+  - goauthentik.io/providers/oauth2/scope-profile
+redirect_uris:
+  - matching_mode: strict
+    url: https://mail.unkin.net/oauth2/callback

config/roles/akR-global-admin.yaml

@@ -10,6 +10,7 @@ permissions:
   - akP-traefik-admin
   - akP-logviewer-admin
   - akP-vlogs-admin
+  - akP-mail-users
   - akP-watchstate-admin
   - akP-repospawner-admin
   - akP-vault-admin