Scaffold terraform-rancher: Authentik OIDC auth config

Manages Rancher's Keycloak(OIDC) auth provider via the rancher2 provider,
pointed at Authentik. Mirrors the terraform-authentik layout (terragrunt +
Vault-sourced secrets + Woodpecker plan/apply/pre-commit pipelines).

- modules/rancher: rancher2_auth_config_keycloak_oidc, client_secret read from
  Vault (kv/kubernetes/namespace/cattle-system/default/oauth-credentials);
  access_mode unrestricted to avoid admin lockout on enable.
- config/keycloakoidc.yaml: issuer/auth_endpoint at identity.unkin.net,
  client_id rancher, /verify-auth redirect, openid/profile/email scopes.
- environments/rancher.k8s.syd1.au.unkin.net: consul state at
  infra/terraform/rancher/, rancher2 provider api_url from the env name.
- rancher2 admin token read from kv/service/terraform/rancher (Makefile);
  to migrate to a dedicated Vault Rancher secrets engine (90-day token cap).

Validated with `tofu validate` (config valid against the rancher2 provider).
A live `plan` needs the Rancher admin API token seeded in Vault first.

Makefile

@@ -0,0 +1,42 @@
+.PHONY: init plan apply format
+
+VAULT_AUTH_METHOD ?= approle
+VAULT_K8S_ROLE ?= woodpecker_terraform_rancher
+VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
+VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
+# kv-v2 location of the Rancher admin API token used by the rancher2 provider.
+# TODO: migrate to the dedicated Vault Rancher secrets engine once it exists
+# (swap the `vault kv get` below for `vault read -field=token rancher/creds/<role>`).
+# Until then note Rancher API tokens have a 90-day max lifetime and must be rotated.
+RANCHER_TOKEN_KV_MOUNT ?= kv
+RANCHER_TOKEN_KV_PATH ?= service/terraform/rancher
+RANCHER_TOKEN_KV_FIELD ?= token
+
+define vault_env
+	@export VAULT_ADDR="https://vault.service.consul:8200" && \
+	if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
+		export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
+	else \
+		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
+	fi && \
+	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-rancher) && \
+	export TF_VAR_rancher_token=$$(vault kv get -mount=$(RANCHER_TOKEN_KV_MOUNT) -field=$(RANCHER_TOKEN_KV_FIELD) $(RANCHER_TOKEN_KV_PATH))
+endef
+
+init:
+	@$(call vault_env) && \
+	terragrunt run --all --non-interactive init -- -upgrade
+
+plan: init
+	@$(call vault_env) && \
+	terragrunt run --all --parallelism 4 --non-interactive plan
+
+apply: init
+	@$(call vault_env) && \
+	terragrunt run --all --parallelism 2 --non-interactive apply
+
+format:
+	@echo "Formatting OpenTofu files..."
+	@tofu fmt -recursive .
+	@echo "Formatting Terragrunt files..."
+	@terragrunt hcl fmt