Idempotent GraphQL bootstrap job (verified live): /finalize with the random SOPS admin, then the OIDC strategy and the groups 'authentik Admins' (full) and 'wiki-anwender' (read /anwender), Guests locked. Replaces the manual setup wizard entirely. OIDC client_id/secret in a SOPS secret; NetworkPolicy lets the job reach wikijs. Script as a fixed-name ConfigMap; re-run = delete the Job.