Manage the agent API service account and token in Terraform

The Authentik API token used by estate automation was created by hand in the
UI and pasted into Vault, so it was undocumented, unauditable and impossible
to rotate reproducibly. Model it as config instead.

Add a service_accounts config kind, discovered from config/service_accounts/
like the other kinds. Each entry creates a service_account user, an RBAC role
carrying its global permissions, its API tokens, and (optionally) a kv-v2
write publishing each token key.

Add sa-agent-api granting view_outpost, view_token and view_token_key, with a
non-expiring api token agent-api-token published to kv/service/authentik/agent-api-token.

modules/authentik/variables.tf

@@ -127,3 +127,28 @@ variable "providers_ldap" {
   }))
   default = {}
 }
+
+# Machine identities for automation (agents, CI). Each entry creates a service
+# account user, an RBAC role carrying its global permissions, and any API tokens
+# it needs. The username is the map key (the config filename).
+variable "service_accounts" {
+  type = map(object({
+    name        = optional(string, null) # display name; defaults to the key
+    description = optional(string, "")
+    # Global RBAC permissions granted via a dedicated role, in
+    # `<app_label>.<codename>` form (e.g. authentik_outposts.view_outpost).
+    permissions = optional(list(string), [])
+    # API tokens keyed by identifier. Set `vault` to publish the generated key
+    # into kv-v2 so consumers read it from Vault instead of an operator pasting it.
+    tokens = optional(map(object({
+      description = optional(string, "")
+      expiring    = optional(bool, false)
+      vault = optional(object({
+        mount = string
+        path  = string
+        key   = optional(string, "token")
+      }), null)
+    })), {})
+  }))
+  default = {}
+}