Deploy Authentik as Identity Provider for Matrix (Stage 1)

Add Authentik v2026.x with embedded PostgreSQL in new namespace. Includes HelmRelease with valuesFrom injection for encrypted credentials, cert-manager Certificate for auth.axion1337.chat, and Traefik IngressRoute. Authentik serves as OIDC provider for MAS; registration via invitation links only.

DNS A-record setup and Authentik UI configuration (OIDC provider creation) are manual post-deployment steps.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

clusters/matrix/flux-system/authentik-sync.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: authentik-apps
+  namespace: flux-system
+spec:
+  interval: 1m
+  path: ./apps/authentik
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+    - name: infra-apps

clusters/matrix/flux-system/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - infra-sync.yaml
   - monitoring-sync.yaml
   - production-sync.yaml
+  - authentik-sync.yaml