authentik: add fsGroup:1000 to server + worker so non-root uid can write /media

PermissionError: [Errno 13] Permission denied: '/media/public' in tenant_files
migration because Authentik container runs as uid 1000 but Longhorn PVC mounts
root:root by default. fsGroup on Pod securityContext recursively chgrps the
PVC mount to gid 1000 + chmods g+rwx.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/authentik/authentik.yaml

@@ -227,6 +227,11 @@ spec:
       labels:
         app: authentik-server
     spec:
+      securityContext:
+        # Authentik image runs as uid 1000 "authentik" but the Longhorn PVC mounts
+        # root:root by default. fsGroup recursively chgrp + chmod g+rwx so the
+        # non-root container can mkdir /media/public during the tenant_files migration.
+        fsGroup: 1000
       containers:
         - name: server
           image: ghcr.io/goauthentik/server:2024.12.3
@@ -330,6 +335,9 @@ spec:
       labels:
         app: authentik-worker
     spec:
+      securityContext:
+        # Same as server pod — non-root uid 1000 needs PVC group write.
+        fsGroup: 1000
       containers:
         - name: worker
           image: ghcr.io/goauthentik/server:2024.12.3