Fix self-referential authentik_group parents

Adding the first managed group (argocd-admins) exposed a dormant bug: the
groups resource resolved `parents` by indexing authentik_group.this itself,
which OpenTofu rejects as a self-referential block. config/groups/ had been
empty, so `tofu plan` never hit it before.

Pass `parents` through as literal group PKs instead (the resource cannot
reference itself, so parent-by-map-key was never viable). Plan is clean:
3 to add (argocd provider, application, argocd-admins group).

modules/authentik/main.tf

@@ -3,7 +3,7 @@ resource "authentik_group" "this" {
 
   name         = each.value.name
   is_superuser = each.value.is_superuser
-  parents      = each.value.parents != null ? [for p in each.value.parents : authentik_group.this[p].id] : []
+  parents      = each.value.parents
   attributes   = jsonencode(each.value.attributes)
 }
 

modules/authentik/variables.tf

@@ -2,8 +2,10 @@ variable "groups" {
   type = map(object({
     name         = string
     is_superuser = optional(bool, false)
-    parents      = optional(list(string), null)
+    # PKs of existing parent groups. These must be literal group PKs, not keys
-    attributes   = optional(map(string), {})
+    # into this map: authentik_group cannot reference itself.
+    parents    = optional(list(string), null)
+    attributes = optional(map(string), {})
   }))
   default = {}
 }