Allow all Authentik users to access Mealie

Remove admins-only policy binding from Mealie app. Any authenticated
Authentik user can log in (account auto-created). Mealie's
OIDC_ADMIN_GROUP=admins handles admin privilege mapping internally.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

argocd/manifests/authentik/configmap-blueprint.yaml

@@ -377,7 +377,7 @@ data:
           sub_mode: hashed_user_id
           include_claims_in_id_token: true
 
-      # Mealie application — restricted to admins group
+      # Mealie application — all authenticated users allowed (admin mapped via OIDC_ADMIN_GROUP)
       - model: authentik_core.application
         id: mealie-app
         identifiers:
@@ -387,18 +387,4 @@ data:
           slug: mealie
           provider: !KeyOf mealie-provider
           meta_launch_url: https://meals.ops.eblu.me
-          policy_engine_mode: any
-
-      # Policy binding — restrict Mealie to admins group
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf mealie-app
-          group: !Find [authentik_core.group, [name, admins]]
-        attrs:
-          target: !KeyOf mealie-app
-          group: !Find [authentik_core.group, [name, admins]]
-          order: 0
-          enabled: true
-          negate: false
-          timeout: 30
+          policy_engine_mode: all