feat: Authentik Terraform configuration for homelab SSO

Infrastructure as Code for Authentik identity provider managing:

OAuth2/OIDC Applications:
- Grafana, Home Assistant, Immich
- Uptime Kuma (proxy auth)
- Sonarr, Radarr, Prowlarr (*arr stack proxy auth)
- ArgoCD

Identity Sources:
- Google Workspace federation

LDAP:
- TrueNAS LDAP provider and outpost

CI/CD:
- GitHub Actions workflow for plan/apply
- Secrets managed via GitHub Actions secrets

Provider: beryju/authentik v2025.2

app-uptime-kuma.tf

@@ -0,0 +1,30 @@
+# =============================================================================
+# Uptime Kuma - Status Monitoring
+# Uses proxy authentication (UK doesn't support native OIDC login)
+# =============================================================================
+
+resource "authentik_provider_proxy" "uptime_kuma" {
+  name               = "Uptime Kuma Proxy"
+  authorization_flow = data.authentik_flow.default_authorization.id
+  invalidation_flow  = data.authentik_flow.default_invalidation.id
+  mode               = "forward_single"
+  
+  external_host         = "https://uptime.example.com"  # TODO: Update
+  access_token_validity = "hours=24"
+}
+
+resource "authentik_application" "uptime_kuma" {
+  name              = "Uptime Kuma"
+  slug              = "uptime-kuma"
+  protocol_provider = authentik_provider_proxy.uptime_kuma.id
+  
+  meta_description = "Service Status Monitoring"
+  meta_launch_url  = "https://uptime.example.com"  # TODO: Update
+  
+  group = "Monitoring"
+}
+
+# Note: Configure your reverse proxy (nginx/traefik/cloudflare) 
+# to use Authentik forward auth before proxying to Uptime Kuma
+# 
+# With disableAuth=true in UK, Authentik handles all authentication