authentik: roll server + ldap-outpost to 2026.5.3, pin chart to match

Bumps the samba-bridge fork images 2026.2.3 -> 2026.5.3 (built from
authentik-samba-bridge#f02b945 / PR #1) and pins the Helm chart to
2026.5.3 so chart appVersion and the running app image are in lockstep.

- global.image.tag:           2026.2.3-b06668e -> 2026.5.3-f02b945
- ldap-outpost container_image: 2026.2.3-0140972 -> 2026.5.3-f02b945
- chart version: ">=2025.12.0" (floated to 2026.5.3) -> pinned "2026.5.3"

Both images verified present in the gitea registry. The fork bump
validated the samba patch and server build assumptions (TENANT_APPS
sed, ManagedAppConfig, python3.14 venv, ldap runtime contract) against
upstream version/2026.5.3 before building.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

kubernetes/apps/authentik/blueprints-configmap.yaml

@@ -555,7 +555,7 @@ data:
             # return entries instead of short-circuiting. Built from
             # the samba-bridge repo at
             # gitea.renner.uno/k.renner/authentik-samba-bridge .
-            container_image: gitea.renner.uno/k.renner/authentik-samba-bridge-ldap-outpost:2026.2.3-0140972
+            container_image: gitea.renner.uno/k.renner/authentik-samba-bridge-ldap-outpost:2026.5.3-f02b945
             object_naming_template: "ak-outpost-%(name)s"
             kubernetes_namespace: authentik
             kubernetes_replicas: 1

kubernetes/apps/authentik/helmrelease.yaml

@@ -17,7 +17,10 @@ spec:
   chart:
     spec:
       chart: authentik
-      version: ">=2025.12.0"
+      # Pinned to match the samba-bridge fork's app image (server.Dockerfile
+      # AUTHENTIK_VERSION). Bump in lockstep with the bridge rebuild — a
+      # floating range drifts the chart ahead of the pinned app image.
+      version: "2026.5.3"
       sourceRef:
         kind: HelmRepository
         name: authentik
@@ -49,7 +52,7 @@ spec:
         # 2. Pinning means the deployed binary is traceable to a
         #    specific repo commit. Bump the tag whenever a new build
         #    is published from gitea.renner.uno/k.renner/authentik-samba-bridge .
-        tag: "2026.2.3-b06668e"
+        tag: "2026.5.3-f02b945"
       envFrom:
         # SAMBA_BRIDGE_DOMAIN_SID / _ENABLED_GROUP / _UID_OFFSET
         # consumed by the bridge module at Django app startup. Missing