Creates the OAuth2 provider, application, lisilou-admin group, and the
client enrollment flow via the Authentik API, then prints ready-to-paste
api/.env lines. Run with AUTHENTIK_URL + AUTHENTIK_TOKEN once CT121 is up.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>