authentik: serve LDAP via an outpost behind the internal gateway

Adds the LDAP outpost deployment and routes ports 389 and 636 on
gateway-internal to it. 636 is a TLS listener in Terminate mode so
cert-manager renews the LDAPS certificate automatically, and both
listeners forward to the outpost's plaintext 3389.

allowedRoutes.kinds is set explicitly on both listeners: a TCP listener
permits no route kinds by default and a TLS listener defaults to
TLSRoute, so the TCPRoute would not attach otherwise.

applications/authentik/ldap/deployment.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: authentik-ldap
+  template:
+    metadata:
+      labels:
+        app: authentik-ldap
+    spec:
+      containers:
+        - name: ldap
+          image: ghcr.io/goauthentik/ldap:2026.8.0
+          ports:
+            - containerPort: 3389
+              name: ldap
+            - containerPort: 6636
+              name: ldaps
+            - containerPort: 9300
+              name: metrics
+          envFrom:
+            - secretRef:
+                name: authentik-ldap-secrets
+          livenessProbe:
+            httpGet:
+              path: /outpost.goauthentik.io/ping
+              port: 9300
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /outpost.goauthentik.io/ping
+              port: 9300
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              memory: 256Mi