policies: let terraform-authentik read its provider API token

Grant the terraform_authentik approle / woodpecker_terraform_authentik
k8s role read on kv/data/service/terraform/authentik so the Makefile can
export TF_VAR_authentik_token for the authentik provider.

policies/kv/service/terraform/authentik.yaml

@@ -1,9 +1,12 @@
-# Allow the Terraform Authentik runner to read OAuth2/OIDC client secrets that
+# Allow the Terraform Authentik runner to read:
-# back authentik providers. Secrets live under each target service's kv
+#  - its own Authentik API token (provider auth), and
-# namespace path (kv/kubernetes/namespace/<ns>/default/oauth-credentials) and
+#  - OAuth2/OIDC client secrets that back authentik providers (per target
-# are read by the module's data.vault_kv_secret_v2 lookups.
+#    service's kv namespace path, via the module's data.vault_kv_secret_v2).
 ---
 rules:
+  - path: "kv/data/service/terraform/authentik"
+    capabilities:
+      - read
   - path: "kv/data/kubernetes/namespace/+/default/oauth-credentials"
     capabilities:
       - read