Manage Rancher users, global roles, tokens and settings

Extend the yaml-discovery config to four more rancher2 kinds so Rancher
objects beyond the OIDC auth provider stop being unmanaged clickops.

- Discover config/users, config/roles, config/tokens and config/settings
  in config/config.hcl and pass them through terragrunt.hcl
- Add rancher2_user (password from Vault kv-v2) plus per-user
  rancher2_global_role_binding on "<username>/<role>" keys
- Add rancher2_global_role with dynamic rules blocks
- Add rancher2_token, documenting that the provider has no user selector
- Add rancher2_setting and seed config/settings/server-url.yaml
- Document every yaml schema in the README

README.md

@@ -7,9 +7,18 @@ provider. Mirrors the `terraform-authentik` pattern.
 ## Managed Resources
 
 - **Keycloak(OIDC) auth config** — Authentik OIDC login for Rancher.
+- **Global role bindings** — Authentik group → Rancher global role.
+- **Users** — Rancher-local users and their global roles.
+- **Global roles** — custom Rancher global roles.
+- **Tokens** — API tokens for the identity Terraform authenticates as.
+- **Settings** — Rancher settings such as `server-url`.
 
 ## Configuration
 
+Every kind is discovered from YAML by `config/config.hcl`: the file name is the
+object's key/name and the file body holds its attributes. Adding a file is the
+only step needed to manage a new object; an empty directory means an empty map.
+
 `config/keycloakoidc.yaml` defines the auth provider. The OAuth client secret is
 read from Vault (kv-v2) — the same secret Authentik sets on its `rancher`
 provider — and is never committed.
@@ -18,6 +27,67 @@ provider — and is never committed.
 roles are granted to users/groups separately. This avoids locking the admin out
 when the provider is first enabled.
 
+### `config/global_role_bindings/<group>.yaml`
+
+```yaml
+global_role_id: admin
+```
+
+### `config/users/<username>.yaml`
+
+```yaml
+name: Some Person           # optional display name, defaults to the file name
+enabled: true               # optional, default true
+must_change_password: false # optional, default false
+password_vault:             # required — rancher2_user requires a password
+  mount: kv
+  path: service/rancher/users/someperson
+  key: password             # optional, default "password"
+global_role_bindings:       # optional
+  - user
+```
+
+The password is read from Vault **at plan time**, so seed the kv-v2 secret
+before adding the file, or the plan fails.
+
+### `config/roles/<name>.yaml`
+
+```yaml
+description: Read-only across all clusters
+new_user_default: false     # optional, default false
+inherited_cluster_roles:    # optional
+  - view
+rules:                      # optional
+  - api_groups: ["management.cattle.io"]
+    resources: ["clusters"]
+    verbs: ["get", "list", "watch"]
+    # non_resource_urls and resource_names are also supported
+```
+
+### `config/tokens/<name>.yaml`
+
+```yaml
+description: CI token       # optional, defaults to the file name
+ttl: 7776000                # optional, seconds
+renew: true                 # optional
+cluster_id: c-m-abcdefgh    # optional, scopes the token to one cluster
+```
+
+> **Caveat:** `rancher2_token` has no user selector — `user_id` is computed by
+> the provider (14.1.1), not settable. Tokens declared here are minted for the
+> identity the rancher2 provider authenticates as (the admin token Terraform
+> runs with), **not** for users in `config/users/`. A token for another user has
+> to be created by that user. Token values land in Terraform state.
+
+### `config/settings/<name>.yaml`
+
+```yaml
+value: https://rancher.k8s.syd1.au.unkin.net
+```
+
+Rancher ships defaults for its settings, so an entry takes over an existing
+setting rather than creating a new one.
+
 ## Usage
 
 ```sh