Derive group name from filename; use distinct ak_groups claim

- Permission/role group name now comes from the config filename (the map key),
  dropping the redundant `name` field from each YAML and the object types.
- The hierarchical mapping emits an `ak_groups` claim (scope `ak_groups`) instead
  of `groups`, so it never collides with the direct-groups the default profile
  mapping already emits under `groups` (Authentik overrides same-key claims in an
  unpredictable order). Apps request the `ak_groups` scope and read that claim.

config/roles/akR-global-admin.yaml

@@ -0,0 +1,5 @@
+# Role akR-global-admin (name = filename): full admin across all onboarded apps.
+permissions:
+  - akP-grafana-admin
+  - akP-argocd-admin
+  - akP-rancher-admin