Grant the vault deployer read on the Authentik OIDC client secret (#146)

**Why:** the terraform-vault deployer must read the OpenBao OIDC client credentials that Authentik's provider module generates before it can configure `auth/oidc`, and AppRole capabilities are fixed at login so the grant has to exist in a prior apply.

**How:**
- Add `policies/kv/service/authentik/oidc-vault/read.yaml`: read on `kv/data/service/authentik/oidc-vault` for the deployer identities (approle `tf_vault`, k8s/au/syd1 `woodpecker_terraform_vault`); `terraform_authentik` still owns the write side of `kv/service/authentik/*`.

**Merge order:** this PR must merge and apply *before* the follow-up PR that adds the `auth/oidc` modules. OIDC becomes the default human auth path; approle/k8s (CI and agents) and break-glass are unchanged.

Reviewed-on: #146
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

policies/kv/service/authentik/oidc-vault/read.yaml

@@ -0,0 +1,21 @@
+# Let the terraform-vault deployer read the OpenBao OIDC client credentials that
+# Authentik's provider module generates and writes here (terraform_authentik owns
+# kv/service/authentik/* — see policies/kv/service/authentik/write.yaml). The
+# deployer consumes client_id/client_secret to configure the auth/oidc backend.
+#
+# OIDC becomes the default human auth path; approle and k8s (CI and agents) plus
+# the break-glass root path are unchanged.
+#
+# AppRole capabilities are fixed at login, so this grant must be applied before
+# the PR that adds the auth/oidc modules.
+---
+rules:
+  - path: "kv/data/service/authentik/oidc-vault"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault