Scaffold terraform-rancher: Authentik OIDC auth config

Manages Rancher's Keycloak(OIDC) auth provider via the rancher2 provider,
pointed at Authentik. Mirrors the terraform-authentik layout (terragrunt +
Vault-sourced secrets + Woodpecker plan/apply/pre-commit pipelines).

- modules/rancher: rancher2_auth_config_keycloak_oidc, client_secret read from
  Vault (kv/kubernetes/namespace/cattle-system/default/oauth-credentials);
  access_mode unrestricted to avoid admin lockout on enable.
- config/keycloakoidc.yaml: issuer/auth_endpoint at identity.unkin.net,
  client_id rancher, /verify-auth redirect, openid/profile/email scopes.
- environments/rancher.k8s.syd1.au.unkin.net: consul state at
  infra/terraform/rancher/, rancher2 provider api_url from the env name.
- rancher2 admin token read from kv/service/terraform/rancher (Makefile);
  to migrate to a dedicated Vault Rancher secrets engine (90-day token cap).

Validated with `tofu validate` (config valid against the rancher2 provider).
A live `plan` needs the Rancher admin API token seeded in Vault first.

modules/rancher/variables.tf

@@ -0,0 +1,19 @@
+variable "keycloakoidc" {
+  description = "Rancher Keycloak(OIDC) auth provider config, or null to leave unmanaged."
+  type = object({
+    rancher_url   = string # Rancher redirect URL, must end with /verify-auth
+    client_id     = string
+    issuer        = string # OIDC issuer (Authentik application URL)
+    auth_endpoint = string # OIDC authorization endpoint
+    scopes        = optional(string, "openid profile email")
+    access_mode   = optional(string, "unrestricted")
+    enabled       = optional(bool, true)
+    # client_secret is never committed. Point at a Vault kv-v2 secret whose
+    # `client_secret` key holds the value (seeded out of band); TF reads it.
+    client_secret_vault = optional(object({
+      mount = string
+      path  = string
+    }), null)
+  })
+  default = null
+}