extract dbaas, authentik, crowdsec from platform into independent stacks [ci skip]

Phase 1 of platform stack split for parallel CI applies.
All 3 modules were fully independent (no cross-module refs).
State migrated via terraform state mv. All 3 stacks applied
with zero changes (dbaas had pre-existing ResourceQuota drift).
Woodpecker pipeline updated to run extracted stacks in parallel.

stacks/authentik/main.tf

@@ -0,0 +1,25 @@
+# =============================================================================
+# Authentik Stack — Identity provider (SSO)
+# =============================================================================
+
+variable "tls_secret_name" { type = string }
+variable "redis_host" { type = string }
+
+data "vault_kv_secret_v2" "secrets" {
+  mount = "secret"
+  name  = "platform"
+}
+
+locals {
+  homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
+}
+
+module "authentik" {
+  source            = "./modules/authentik"
+  tier              = local.tiers.cluster
+  tls_secret_name   = var.tls_secret_name
+  secret_key        = data.vault_kv_secret_v2.secrets.data["authentik_secret_key"]
+  postgres_password = data.vault_kv_secret_v2.secrets.data["authentik_postgres_password"]
+  redis_host        = var.redis_host
+  homepage_token    = try(local.homepage_credentials["authentik"]["token"], "")
+}