Default OAuth2 providers to RS256 ID token signing

OAuth2 providers with no signing_key fall back to HS256, which RS256-only
RP clients (argocd confirmed, and the rest) reject with "unexpected
signature algorithm HS256; expected [RS256]", breaking OIDC login.

- Add data.authentik_certificate_key_pair.signing, resolving the estate's
  RSA keypair by name (var.oauth2_signing_key_name, default the built-in
  "authentik Self-signed Certificate").
- Default every provider's signing_key to that keypair via coalesce, so all
  providers sign with RS256 while keeping the per-yaml signing_key override.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

modules/authentik/main.tf

@@ -142,6 +142,13 @@ data "vault_kv_secret_v2" "oauth2" {
   name     = each.value.client_secret_vault.path
 }
 
+# Default JWT signing key for OAuth2 providers. Without a signing_key Authentik
+# signs ID tokens with HS256, which RS256-only RP clients (argocd, grafana, ...)
+# reject. Look up the estate's RSA keypair by name so providers default to RS256.
+data "authentik_certificate_key_pair" "signing" {
+  name = var.oauth2_signing_key_name
+}
+
 resource "authentik_provider_oauth2" "this" {
   for_each = var.providers_oauth2
 
@@ -156,7 +163,7 @@ resource "authentik_provider_oauth2" "this" {
     [authentik_property_mapping_provider_scope.groups_hierarchical.id],
     try([authentik_property_mapping_provider_scope.role[each.key].id], []),
   )
-  signing_key           = each.value.signing_key
+  signing_key           = coalesce(each.value.signing_key, data.authentik_certificate_key_pair.signing.id)
   access_token_validity = each.value.access_token_validity
   allowed_redirect_uris = each.value.redirect_uris
   grant_types           = each.value.grant_types

modules/authentik/variables.tf

@@ -98,6 +98,14 @@ variable "providers_oauth2" {
   default = {}
 }
 
+# Name of the RSA certificate keypair used to sign OAuth2 ID tokens (RS256) for
+# every provider that does not set its own signing_key. Defaults to Authentik's
+# built-in self-signed RSA keypair.
+variable "oauth2_signing_key_name" {
+  type    = string
+  default = "authentik Self-signed Certificate"
+}
+
 variable "providers_ldap" {
   type = map(object({
     name             = string