feat: Add Portainer OAuth2 + enable RBAC policy bindings

- Add app-portainer.tf: OAuth2 provider for Portainer container management
- Add portainer_url variable
- Enable RBAC policy bindings for Grafana, ArgoCD, Home Assistant
- Portainer bound to Infrastructure group policy

RBAC Summary:
- Infrastructure group → Grafana, ArgoCD, Portainer
- Home Automation group → Home Assistant
- Media group → arr stack (existing in app-proxy-arr-stack.tf)

variables.tf

@@ -82,6 +82,12 @@ variable "prowlarr_url" {
   description = "Prowlarr URL for proxy auth"
 }
 
+variable "portainer_url" {
+  type        = string
+  default     = ""
+  description = "Portainer URL for SSO"
+}
+
 # LDAP Configuration
 variable "ldap_base_dn" {
   type        = string