fix(radius): wlan-setup authentik subrequests take large replies

- subrequest_output_buffer_size 256k: users/me with groups, avatar and
  permissions exceeds the one-page default and was cut off.
- proxy_pass_request_headers off: browser headers (Accept-Encoding,
  User-Agent, X-authentik-*) no longer reach authentik.
- Random suffix on the app password identifier, so two installs in the
  same second do not collide.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kubernetes/apps/authentik/wlan-setup-config.yaml

@@ -175,6 +175,10 @@ data:
         location ~ ^/_ak(/.*)$ {
             internal;
             proxy_pass http://authentik$1;
+            # njs reads the whole reply from this buffer (default one page).
+            subrequest_output_buffer_size 256k;
+            # Only the headers set here reach authentik.
+            proxy_pass_request_headers off;
             proxy_set_header Host auth.renner.uno;
             proxy_set_header Cookie "";
             proxy_set_header Authorization "$arg_scheme $arg_cred";
@@ -324,7 +328,7 @@ data:
 
             const now = new Date();
             const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\..*$/, "");
-            const identifier = "wlan-android-" + user.replace(/[^A-Za-z0-9-]/g, "-").toLowerCase() + "-" + stamp;
+            const identifier = "wlan-android-" + user.replace(/[^A-Za-z0-9-]/g, "-").toLowerCase() + "-" + stamp + "-" + random().substring(0, 6).replace(/[^A-Za-z0-9]/g, "x");
             const expires = new Date(now.getTime() + LIFETIME_DAYS * 86400000).toISOString();
             await ak(r, "POST", "/api/v3/core/tokens/", "Bearer", access, JSON_CT, JSON.stringify({
                 identifier: identifier,