Grant terraform-authentik write on the kv/service/authentik subtree (#140)

## Why

`kv/service/authentik/agent-api-token` is seeded by hand today. terraform-authentik should own it as IaC (`vault_kv_secret_v2`), along with any future Authentik automation tokens, but its runner identities only hold read on `kv/service/terraform/authentik` and the per-namespace oauth-credentials paths.

This must land and **apply** first: an AppRole/k8s token's capabilities are fixed at login, so the companion terraform-authentik PR would fail its very first plan against a policy that is not yet live.

## How

- Adds `policies/kv/service/authentik/write.yaml`, granting:
  - `kv/data/service/authentik/*` — create, read, update, delete
  - `kv/metadata/service/authentik/*` — read, list, delete
- Assigned to the same identities that already hold the terraform-authentik read policy: approle `terraform_authentik` and `k8s/au/syd1` role `woodpecker_terraform_authentik`.
- `delete` is included (unlike the `kv/kubernetes` agents grant) so `terraform destroy` and resource replacement clean up both the data and the metadata; metadata `read`/`list` is what `vault_kv_secret_v2` hits on every plan.
- Scope note in the file header: the ask was to scope to `*-token` paths, but Vault ACL paths only support a trailing glob, so the whole `kv/service/authentik/` subtree is granted. terraform-authentik is the owner of everything under that prefix.
- Existing `policies/kv/service/authentik/agent-api-token/read.yaml` (agents approle) is untouched.

## Order

Merge + apply this first; the companion terraform-authentik PR merges only afterwards.

Reviewed-on: #140
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

policies/kv/service/authentik/write.yaml

@@ -0,0 +1,32 @@
+# Let the terraform-authentik runner manage the Authentik service KV subtree as
+# IaC (vault_kv_secret_v2), starting with kv/service/authentik/agent-api-token,
+# which is currently seeded by hand.
+#
+# Scoping: the ask was to grant only *-token paths, but Vault ACL paths support
+# a trailing glob only (no infix/suffix wildcards), so the grant is the whole
+# kv/service/authentik/ subtree. That is acceptable because terraform-authentik
+# is the owner of every secret under kv/service/authentik/.
+#
+# delete is included (unlike the agents kv/kubernetes grant) so `terraform
+# destroy` and resource replacement can remove a secret and its metadata
+# cleanly; vault_kv_secret_v2 also reads the kv-v2 metadata path on every
+# plan/apply, so metadata read/list is required for the plan to succeed.
+---
+rules:
+  - path: "kv/data/service/authentik/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  - path: "kv/metadata/service/authentik/*"
+    capabilities:
+      - read
+      - list
+      - delete
+
+auth:
+  approle:
+    - terraform_authentik
+  k8s/au/syd1:
+    - woodpecker_terraform_authentik