Review deploy-authentik: rewrite as process guide (#257)

## Summary
- Rewrites deploy-authentik from a historical changelog into a reproducible process guide
- Removes stale version info (`v1.1.2-nix`) and future work section (Forgejo federation is done, rest belongs elsewhere)
- Marks deploy-authentik as completed in plans index and completed archive
- Removes hardcoded image tag from authentik reference card (use `service-versions.yaml`)
- Adds `last-reviewed: 2026-02-23` frontmatter

## Test plan
- [x] All pre-commit hooks pass (docs-check-links, docs-check-index, etc.)
- [x] ArgoCD app verified synced and healthy
- [x] All wiki-links validated

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/257

docs/reference/services/authentik.md

@@ -20,7 +20,6 @@ OIDC identity provider for BlumeOps. Authentik is the **source of truth** for us
 | **Tailscale URL** | https://authentik.tail8d86e.ts.net |
 | **Namespace** | `authentik` |
 | **Cluster** | k3s (ringtail) |
-| **Image** | `registry.ops.eblu.me/blumeops/authentik:v1.1.2-nix` |
 | **Manifests** | `argocd/manifests/authentik/` |
 | **Container build** | `containers/authentik/default.nix` |