fix: resolve REPLACE_ME placeholder in argocd/apps/authentik.yaml

The placeholder targetRevision reached origin/main and broke the Application's
comparison (ComparisonError: "improper constraint: REPLACE_ME"), showing as a
broken card in the Argo CD UI. The actual Authentik pods were never affected
(sync policy has no `automated` block, so nothing was ever applied against the
live release) -- confirmed all authentik namespace pods stayed Running 1/1
throughout.

Fixed using the real deployed chart version read off the live authentik-server
pod's helm.sh/chart=authentik-2026.2.1 label, not a guess.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

argocd/apps/authentik.yaml

@@ -1,11 +1,9 @@
-# NEEDS YOUR INPUT before first sync: targetRevision below is a placeholder.
-# Run `helm list -n authentik` on the live cluster and set this to the chart
-# version actually deployed (installed by hand per the header comment in
-# values/authentik.yaml) -- Authentik is the SSO IdP gating Argo CD/Grafana/
-# Gitea logins, so adopting it into GitOps with the wrong version could
-# trigger an unwanted live chart upgrade/downgrade on first sync. Sync is
-# left manual (no `automated:` block) until you've confirmed this and diffed
-# with `kubectl diff` / `argocd app diff`.
+# targetRevision below is confirmed against the live deployment's
+# helm.sh/chart=authentik-2026.2.1 label on the authentik-server pod (checked
+# 2026-07-23) -- not a guess. Sync is still left manual (no `automated:`
+# block): diff with `kubectl diff` / `argocd app diff` before enabling
+# automated sync, since Authentik is the SSO IdP gating Argo CD/Grafana/Gitea
+# logins.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -18,7 +16,7 @@ spec:
   sources:
     - repoURL: https://charts.goauthentik.io
       chart: authentik
-      targetRevision: "REPLACE_ME"
+      targetRevision: "2026.2.1"
       helm:
         valueFiles:
           - $values/values/authentik.yaml