Derive group name from filename; use distinct ak_groups claim

- Permission/role group name now comes from the config filename (the map key),
  dropping the redundant `name` field from each YAML and the object types.
- The hierarchical mapping emits an `ak_groups` claim (scope `ak_groups`) instead
  of `groups`, so it never collides with the direct-groups the default profile
  mapping already emits under `groups` (Authentik overrides same-key claims in an
  unpredictable order). Apps request the `ak_groups` scope and read that claim.

modules/authentik/variables.tf

@@ -16,9 +16,9 @@ variable "groups" {
 # role is an effective member of every permission it grants (Authentik membership
 # propagates child -> parent). Split into two variables/resources so roles can
 # reference permission group ids without the authentik_group self-reference error.
+# The group name is the map key (the config filename); no `name` field needed.
 variable "permission_groups" {
   type = map(object({
-    name = string
     # slug of the oauth2 application this permission grants *access* to; when set,
     # a policy binding is created gating that app to this group (and its children).
     application = optional(string, null)
@@ -29,7 +29,6 @@ variable "permission_groups" {
 
 variable "role_groups" {
   type = map(object({
-    name = string
     # keys into var.permission_groups that this role nests (becomes its parents).
     permissions  = optional(list(string), [])
     is_superuser = optional(bool, false)