Grant agents approle read on kv/service/authentik/agent-api-token

Automation seeds oauth client secrets and LDAP outpost tokens; fetching
outpost tokens needs a scoped Authentik API token, seeded at this path
by the operator.

policies/kv/service/authentik/agent-api-token/read.yaml

@@ -0,0 +1,14 @@
+# Lets the agents AppRole read a dedicated, scoped Authentik API token seeded by
+# the operator. Automation seeds OAuth2 client secrets and LDAP outpost tokens as
+# part of normal IaC workflows; fetching an outpost token requires calling the
+# Authentik API, so a scoped token (not the CI admin credential) is read here.
+# Mirrors the gitea/creds/unkin-agent agents-approle read grant pattern.
+---
+rules:
+  - path: "kv/data/service/authentik/agent-api-token"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - agents