Fix authentik container: create /tmp for unprivileged user

buildLayeredImage doesn't create /tmp by default. The container runs
as user 65534 (nobody) which can't mkdir /tmp at runtime.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

containers/authentik/default.nix

@@ -57,8 +57,8 @@ pkgs.dockerTools.buildLayeredImage {
   # authentik-django hardcodes blueprints_dir to $out/blueprints; the AUTHENTIK_BLUEPRINTS_DIR
   # env var overrides it to /blueprints, where custom blueprints are mounted by k8s ConfigMap.
   extraCommands = ''
-    mkdir -p blueprints
-    chmod 777 blueprints
+    mkdir -p blueprints tmp
+    chmod 777 blueprints tmp
   '';
 
   config = {