Merge pull request 'Manage human role membership from config/users/' (#37) from benvin/media-adult-membership into main

Reviewed-on: #37

config/config.hcl

@@ -42,5 +42,10 @@ locals {
       trimsuffix(basename(file_path), ".yaml") => content
       if startswith(file_path, "service_accounts/")
     }
+    users = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "users/")
+    }
   }
 }

config/users/README.md

@@ -0,0 +1,17 @@
+# users
+
+One file per human, `<username>.yaml`, listing the `akR-*` roles they hold:
+
+```yaml
+# Human user jane (username = filename). The account itself is not managed here
+# (humans come from LDAP sync / invite); only its role membership is.
+roles:
+  - akR-media-adult
+```
+
+The account is looked up by username and must already exist — nothing here
+creates users. A role that has no `config/roles/<name>.yaml` fails the plan.
+
+**Naming a role here makes Terraform authoritative over that role's entire
+member list**: members added by hand in the Authentik UI for that role are
+removed on the next apply. Roles no user file names are left untouched.