Enable SSO via Authentik so eblume (admins group) gets admin access.
Local admin password remains as break-glass. Requires adding
argocd-client-secret field to "Authentik (blumeops)" 1Password item
before deploying.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>