feat(KLEF): Create authentik plugin

[JeremyNRoos]

Pull Request

Summary

• Introduces the idp-authentik Kleff plugin — a gRPC adapter that connects Kleff to a self-hosted Authentik instance
• Automatically configures an OAuth2 provider, application, JWKS endpoint, admin group, and admin user in Authentik on first startup (no manual steps required)
• Gates GetOIDCConfig behind a setupDone flag so the platform's ready check stays false until EnsureSetup completes, preventing users from reaching the login form before the admin account exists
• Adds CI and release GitHub Actions workflows matching the keycloak-plugin pattern

Related Issues

Closes #

---

Changes

What's Included

• cmd/plugin/main.go: wires the hexagonal layers; starts gRPC immediately so the platform can dial while EnsureSetup runs in the background; calls srv.SetReady() once setup succeeds
• internal/adapters/grpc/server.go: implements IdentityPlugin, PluginHealth, and PluginUI gRPC interfaces; GetOIDCConfig returns an empty response until setupDone is set
• internal/adapters/authentik/client.go: HTTP client against the Authentik API — idempotent EnsureSetup, EnsureAdmin, Login, RefreshToken, ValidateToken, Register
• internal/core/application/: service layer
• .github/workflows/ci.yml: build, test, Docker image build on push/PR
• .github/workflows/release.yml: build + push to ghcr.io/kleffio/idp-authentik, create GitHub Release, open auto-merged PR to plugin-registry

What's Not Included

• Redirect auth mode support for Authentik (headless/ROPC only for now)
• User management UI beyond basic registration

---

Testing

How Was This Tested?

• Installed Authentik from the marketplace setup wizard and verified the loading spinner shows until EnsureSetup completes (including admin user and OIDC scopes)
• Logged in as the seeded admin user and verified the admin role is present
• Switched from Keycloak → Authentik and verified no stale redirect to the old IDP

Test Coverage

• Unit tests added or updated
• Integration tests added or updated
• Manually tested end-to-end

---

Breaking Changes

Does this PR introduce breaking changes?

• Yes
• No

---

Security Considerations

• This PR affects authentication or authorization logic
• This PR touches secrets, tokens, or environment variables

AUTHENTIK_BOOTSTRAP_TOKEN is consumed only during setup and never logged. Admin password is set via Authentik's set_password API (not sent in user creation payload). The setupDone flag ensures OIDC config is never exposed before the admin account is confirmed.

---

Documentation

Does this PR require documentation updates?

• Yes
• No

---

UI/UX (If Applicable)

• Includes new components or views

---

Pre-Merge Checklist

• PR title follows semantic format (feat: add idp-authentik plugin)
• All CI checks passing
• Code follows project style guidelines
• No debug logs or commented-out code left in
• Dependencies reviewed (no unnecessary additions)
• No sensitive information included

---

Reviewer Notes

The plugin starts its gRPC server before EnsureSetup finishes (so the platform doesn't time out dialing). GetOIDCConfig returns an empty proto until SetReady() is called, which causes the platform to return {enabled: true, ready: false} and the frontend to show the spinner. SetReady() is only called after the full EnsureSetup succeeds, so the admin user, OAuth2 provider, and OIDC scopes are all guaranteed to exist before ready: true fires.