Manage private auth resources with Terraform

[mulatta]

Move Authentik forward-auth resources, Headscale users/policy, and OIDC client metadata into Terraform.

Highlights:

• Package the Authentik Terraform provider in the flake dev shell.
• Manage Authentik groups, users, proxy providers, apps, policies, and outpost attachments for Authentik-protected apps.
• Keep status.sjanglab.org visible in the Authentik dashboard as a launch-only application without protecting the page.
• Manage Headscale users and ACL policy from the same encrypted user inventory.
• Add lock timeout for Terragrunt stack plans.
• Centralize OIDC client secrets in SOPS for Terraform and Nix consumers.
• Remove the old Gatus Authentik proxy app because the status page is tailnet-only and unauthenticated.

Depends on #602.

[mulatta]

This change is part of the following stack:

• Manage private auth resources with Terraform #603 ◀

_{Change managed by git-spice.}