feat(security): add comprehensive security policies and RBAC

- Add security-policies.tf:
  - Strong password policy (12 chars, HIBP check, zxcvbn scoring)
  - Password reuse prevention (last 5 passwords)
  - Brute force protection (reputation policy, 5 attempt threshold)
  - MFA stages: TOTP, WebAuthn/Passkeys, recovery codes
  - MFA validation stage with configurable enforcement
  - Admin-only and MFA-required expression policies

- Add rbac-groups.tf:
  - Media group (Sonarr, Radarr, etc.)
  - Infrastructure group (Grafana, ArgoCD, etc.)
  - Home Automation group (Home Assistant)
  - Group-based access policies

- Fix main.tf: Remove SOPS, use variables for token
- Fix versions.tf: Remove unused SOPS provider
- Update README with security documentation

main.tf

@@ -3,14 +3,14 @@
 # Update the domain below to match your Authentik instance
 # =============================================================================
 
-# Decrypt secrets with SOPS
-data "sops_file" "secrets" {
-  source_file = "secrets.enc.yaml"
-}
-
+# Authentik Provider Configuration
+# Token provided via:
+# - GitHub Actions secrets (CI/CD)
+# - terraform.tfvars (local dev - never commit!)
+# - TF_VAR_authentik_token environment variable
 provider "authentik" {
   url   = var.authentik_url
-  token = data.sops_file.secrets.data["authentik_token"]
+  token = var.authentik_token
 }
 
 # =============================================================================