Fix authentik container: set TMPDIR=/tmp

lifecycle/ak uses ${TMPDIR}/authentik-mode — without TMPDIR set it
tries to write /authentik-mode in root, which user 65534 can't do.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

containers/authentik/default.nix

@@ -66,6 +66,7 @@ pkgs.dockerTools.buildLayeredImage {
     Env = [
       "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
       "TZDIR=${pkgs.tzdata}/share/zoneinfo"
+      "TMPDIR=/tmp"
       "AUTHENTIK_BLUEPRINTS_DIR=/blueprints"
     ];
     ExposedPorts = {