authentik: serve LDAP via an outpost behind the internal gateway

Adds the LDAP outpost deployment and routes ports 389 and 636 on
gateway-internal to it. 636 is a TLS listener in Terminate mode so
cert-manager renews the LDAPS certificate automatically, and both
listeners forward to the outpost's plaintext 3389.

allowedRoutes.kinds is set explicitly on both listeners: a TCP listener
permits no route kinds by default and a TLS listener defaults to
TLSRoute, so the TCPRoute would not attach otherwise.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

applications/authentik/ldap/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  selector:
+    app: authentik-ldap
+  ports:
+    - name: ldap
+      port: 3389
+      targetPort: 3389
+    - name: metrics
+      port: 9300
+      targetPort: 9300