Add a users/ config kind mapping a human to the akR-* roles they hold.
Look accounts up with data.authentik_user; never declare them. Set
authentik_group.role users only for roles a user file names, leaving
every other role's membership untouched. No assignments yet.