feat(auth): annuaire Authentik + portail consoles Guacamole

- k8s/apps/authentik : IdP OIDC (auth.lab.local), namespace auth —
  server + worker 2026.5.3, Redis in-cluster, PG sur storage-01, PVC media
- k8s/apps/guacamole : portail consoles SSH web s01/g01 (portail.lab.local) —
  guacd + webapp 1.6.0, SSO OIDC vers Authentik, Job initdb idempotent
- ansible : rôle console_user (user sans sudo pour les consoles, s01 + g01),
  bases PG authentik/guacamole, secrets vault (mdp PG + clé SSH console)
- doc : admin/k8s/auth-portal.md (déploiement, config initiale, pièges)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ansible/roles/postgresql/defaults/main.yml

@@ -12,13 +12,16 @@ postgresql_shared_buffers: "256MB"
 # Bases et utilisateurs à créer
 # Mots de passe dans le vault : vault_pg_hermes_password, vault_pg_litellm_password,
 #                               vault_pg_openwebui_password, vault_pg_n8n_password,
-#                               vault_pg_ghostfolio_password
+#                               vault_pg_ghostfolio_password, vault_pg_authentik_password,
+#                               vault_pg_guacamole_password
 postgresql_databases:
   - name: hermes
   - name: litellm
   - name: openwebui
   - name: n8n
   - name: ghostfolio
+  - name: authentik
+  - name: guacamole
 
 postgresql_users:
   - name: hermes
@@ -36,3 +39,9 @@ postgresql_users:
   - name: ghostfolio
     password: "{{ vault_pg_ghostfolio_password }}"
     db: ghostfolio
+  - name: authentik
+    password: "{{ vault_pg_authentik_password }}"
+    db: authentik
+  - name: guacamole
+    password: "{{ vault_pg_guacamole_password }}"
+    db: guacamole