authentik: pin Caddy/Radius outposts to authentik namespace

Caddy and Local Radius outposts came over from the Proxmox deployment
with `kubernetes_namespace: default` in their config. The chart-rendered
Role only grants permissions in `authentik`, so the K8s controller's
first GET against `secrets/ak-outpost-{name}` in `default` returned
403. LDAP Outpost worked because its config never had the field set
(falls back to the running pod's namespace).

Pin both to `authentik` via the existing blueprint so the controller
spawns them next to authentik-server.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/apps/authentik/blueprints-configmap.yaml

@@ -32,12 +32,37 @@ data:
         attrs:
           service_connection: !KeyOf k8s-conn
 
+      # `Caddy` and `Local Radius` carried `kubernetes_namespace: default`
+      # in their config from the Proxmox-era data, which the chart Role
+      # has no permissions for. Pin both at `authentik` so the worker
+      # spawns them next to authentik-server; the Role already grants
+      # the deploy/svc/ingress/secret/configmap perms in this namespace.
+      # The `LDAP Outpost` config never had `kubernetes_namespace` set,
+      # so it defaults to the running pod's namespace and is fine — but
+      # we still pin its service_connection here for symmetry.
       - model: authentik_outposts.outpost
         identifiers:
           name: Caddy
         state: present
         attrs:
           service_connection: !KeyOf k8s-conn
+          config:
+            log_level: info
+            authentik_host: "https://auth.renner.uno/"
+            authentik_host_insecure: false
+            authentik_host_browser: ""
+            refresh_interval: "minutes=5"
+            container_image: null
+            object_naming_template: "ak-outpost-%(name)s"
+            kubernetes_namespace: authentik
+            kubernetes_replicas: 1
+            kubernetes_service_type: ClusterIP
+            kubernetes_disabled_components: []
+            kubernetes_image_pull_secrets: []
+            kubernetes_ingress_annotations: {}
+            kubernetes_ingress_class_name: null
+            kubernetes_ingress_secret_name: "authentik-outpost-tls"
+            kubernetes_json_patches: null
 
       - model: authentik_outposts.outpost
         identifiers:
@@ -52,6 +77,26 @@ data:
         state: present
         attrs:
           service_connection: !KeyOf k8s-conn
+          config:
+            log_level: info
+            authentik_host: "https://auth.renner.uno/"
+            authentik_host_insecure: false
+            authentik_host_browser: ""
+            refresh_interval: "minutes=5"
+            container_image: null
+            object_naming_template: "ak-outpost-%(name)s"
+            kubernetes_namespace: authentik
+            kubernetes_replicas: 1
+            kubernetes_service_type: ClusterIP
+            kubernetes_disabled_components: []
+            kubernetes_image_pull_secrets: []
+            kubernetes_ingress_annotations: {}
+            kubernetes_ingress_class_name: null
+            kubernetes_ingress_secret_name: "authentik-outpost-tls"
+            kubernetes_ingress_path_type: null
+            kubernetes_httproute_annotations: {}
+            kubernetes_httproute_parent_refs: []
+            kubernetes_json_patches: null
 
       - model: authentik_outposts.dockerserviceconnection
         identifiers: