authentik: scope LDAP Synology under its own base DN

Live binds from nas-1 land in the Jellyfin Application's policy
evaluation because the outpost dispatches by base_dn suffix match —
with LDAP Unifi/Jellyfin/Synology all sharing DC=authentik,DC=renner,
DC=uno, the alphabetically-first provider wins every request. Moving
Synology under DC=synology,DC=authentik,DC=renner,DC=uno gives the
outpost a unique suffix to route on. Unifi/Jellyfin are left alone;
neither is LAN-reachable yet so the duplicate-base-DN there is dormant
config, not in this change's scope.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/apps/authentik/blueprints-configmap.yaml

@@ -257,6 +257,17 @@ data:
         attrs:
           is_superuser: false
 
+      # Distinct base DN — the outpost dispatches binds to the provider
+      # whose base_dn is a suffix of the bind DN. The pre-existing LDAP
+      # Unifi / LDAP Jellyfin providers BOTH use `DC=authentik,DC=renner,
+      # DC=uno`; with identical base DNs the first match wins for every
+      # bind, so attaching a third provider with the same base DN would
+      # never receive any binds (binds would land on whichever provider
+      # the outpost happens to order first and get policy-denied against
+      # the wrong Application). Scoping Synology under its own subtree
+      # both routes binds correctly and leaves the existing providers
+      # untouched — a focused fix that doesn't drag Unifi/Jellyfin into
+      # this change.
       - id: ldap-synology-provider
         model: authentik_providers_ldap.ldapprovider
         identifiers:
@@ -265,7 +276,7 @@ data:
         attrs:
           authorization_flow: !Find [authentik_flows.flow, [slug, ldap-authentication-flow]]
           invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
-          base_dn: DC=authentik,DC=renner,DC=uno
+          base_dn: DC=synology,DC=authentik,DC=renner,DC=uno
           bind_mode: direct
           search_mode: direct
           uid_start_number: 2000