fix: Repair matrix-invitation enrollment flow via Authentik Blueprint

The matrix-invitation flow only had Invite+Prompt stage bindings, both
at order=0 (undefined order), missing the Write/Password/Login stages
entirely — invited users were never written to the DB. Applied the fix
live in-cluster (mirroring the working matrix-enrollment stage chain),
and captured it as an Authentik Blueprint (ConfigMap, mounted via
blueprints.configMaps) so the flow state is reproducible via GitOps
instead of manual admin-UI clicks.

apps/authentik/authentik-blueprints.yaml

@@ -0,0 +1,68 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-blueprints
+  namespace: authentik
+data:
+  matrix-invitation-flow.yaml: |
+    # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
+    version: 1
+    metadata:
+      name: matrix-invitation-flow
+      labels:
+        blueprints.goauthentik.io/instantiate: "true"
+    entries:
+      # Reaffirm the flow itself (already created manually; matched by slug)
+      - model: authentik_flows.flow
+        state: present
+        identifiers:
+          slug: matrix-invitation
+        id: matrix_invitation_flow
+        attrs:
+          name: matrix-invitation
+          title: matrix-invitation
+          designation: enrollment
+
+      # Correct stage chain, mirroring the working matrix-enrollment flow:
+      # Invite -> Prompt (username/email/password) -> Write -> Password -> Login
+      # Root cause of the original bug: only Invite+Prompt were bound, both at
+      # order=0, so the flow never wrote the user to the DB or logged them in.
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_invitation_flow
+          order: 0
+        attrs:
+          stage: !Find [authentik_stages_invitation.invitationstage, [name, matrix-enrollment-invitation]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_invitation_flow
+          order: 1
+        attrs:
+          stage: !Find [authentik_stages_prompt.promptstage, [name, matrix-invitation-prompt]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_invitation_flow
+          order: 2
+        attrs:
+          stage: !Find [authentik_stages_user_write.userwritestage, [name, default-source-enrollment-write]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_invitation_flow
+          order: 3
+        attrs:
+          stage: !Find [authentik_stages_password.passwordstage, [name, default-authentication-password]]
+
+      - model: authentik_flows.flowstagebinding
+        state: present
+        identifiers:
+          target: !KeyOf matrix_invitation_flow
+          order: 4
+        attrs:
+          stage: !Find [authentik_stages_user_login.userloginstage, [name, default-source-enrollment-login]]

apps/authentik/authentik.yaml

@@ -52,6 +52,10 @@ spec:
         use_tls: true
         from: "Authentik <gamemaster@axion1337.chat>"
 
+    blueprints:
+      configMaps:
+        - authentik-blueprints
+
     server:
       ingress:
         enabled: false

apps/authentik/kustomization.yaml

@@ -4,6 +4,7 @@ resources:
   - namespace.yaml
   - helm-repo.yaml
   - authentik-secret.yaml
+  - authentik-blueprints.yaml
   - certificate.yaml
   - authentik.yaml
   - ingress.yaml

docs/troubleshooting/README.md

@@ -86,7 +86,7 @@ Dieser Ordner enthält detaillierte Troubleshooting- und Reparaturanleitungen f
 |---------|--------|-------|--------|
 | Nur Standard Enrollment funktioniert | akadmin ✅ | - | Resolved |
 | User nur in Authentik, nicht in Synapse | Boje | `DIAGNOSTIK-AUTHENTIK-FLOW.md` | In Progress |
-| Einladungslink-Fehler: "kein ausstehender benutzer" | Klaus | `AUTHENTIK-CREATE-INVITATION-FLOW.md` | In Progress |
+| Einladungslink-Fehler: "kein ausstehender benutzer" | Klaus | `AUTHENTIK-CREATE-INVITATION-FLOW.md` | **Fixed (2026-07-27)** — `matrix-invitation` Flow hatte nur Invite+Prompt Stage-Bindings, beide auf `order=0`. Write/Password/Login-Stages fehlten komplett. Live gefixt + als Blueprint (`apps/authentik/authentik-blueprints.yaml`) reproduzierbar gemacht. |
 | OIDC-Integration unklar | General | `AUTHENTIK-FIX-TEMPLATE.md` | Reference |
 
 ---