Add logviewer OAuth2 provider/application and akP-logviewer-admin permission

The ClickHouse log UI (logviewer) is being exposed at
https://logviewer.unkin.net behind oauth2-proxy in the logging namespace;
this adds the Authentik side as the prerequisite.

- Adds config/providers_oauth2/logviewer.yaml mirroring traefik: confidential
  client, client_id logviewer, secret from Vault kv
  kubernetes/namespace/logging/default/oauth-credentials,
  openid/email/profile scopes (ak_groups is attached to every oauth2
  provider by the module), strict redirect URI for the
  logviewer oauth2 callback.
- Adds config/permissions/akP-logviewer-admin.yaml bound to the logviewer
  application and nests it under akR-global-admin.

config/permissions/akP-logviewer-admin.yaml

@@ -0,0 +1,3 @@
+# Permission group akP-logviewer-admin (name = filename). Grants admin
+# access to logviewer: bound to the logviewer application, gating the log UI.
+application: logviewer