Integrate Forgejo with Authentik OIDC

Refactor Authentik blueprints into common.yaml (shared admins group),
grafana.yaml (updated with !Find and groups scope), and forgejo.yaml
(new provider + application). Add forgejo-client-secret to ExternalSecret
and worker deployment. Configure Forgejo oauth2_client for auto-registration
with login-based account linking to safely preserve existing accounts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ansible/roles/forgejo/templates/app.ini.j2

@@ -82,7 +82,6 @@ ENABLE_AUTO_REGISTRATION = true
 ACCOUNT_LINKING = login
 USERNAME = nickname
 REGISTER_EMAIL_CONFIRM = false
-SKIP_LOCAL_2FA = true
 
 [actions]
 ENABLED = {{ forgejo_actions_enabled | lower }}