Set explicit launch URL for the LiteLLM application

Ben (akR-global-admin) does not see the LiteLLM tile on the Authentik user
dashboard, while ArgoCD/Grafana/Rancher appear normally. The live API shows
LiteLLM is configured identically to those apps: the app exists, its access
binding akP-litellm-admin -> litellm is present, and akR-global-admin nests
akP-litellm-admin (bidirectionally, same as the others). A CI-style plan against
live state reports "No changes" -- so this is not terraform-correctable drift,
and a plain re-apply fixes nothing. Yet check_access for Ben returns
passing=false for litellm and passing=true for the rest: a stale cached access
policy result inside Authentik.

Add an optional per-app launch_url to the providers_oauth2 config (default null,
which keeps Authentik's redirect-derived URL) and wire it to the application's
meta_launch_url. Set it for LiteLLM to its UI. This makes the dashboard tile
deterministic and, on apply, re-saves the application -- invalidating the stale
access-policy cache so Ben's (already-correct) access re-evaluates and the tile
appears.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

modules/authentik/main.tf

@@ -192,6 +192,8 @@ resource "authentik_application" "oauth2" {
   name              = each.value.name
   slug              = each.key
   protocol_provider = authentik_provider_oauth2.this[each.key].id
+  # Null keeps Authentik's derived launch URL (from the first redirect_uri).
+  meta_launch_url = each.value.launch_url
 }
 
 resource "authentik_application" "ldap" {