feat(authentik): pin known tokens on proxy outposts too

Generalize the outpost token-pinning path beyond the LDAP outpost so any
proxy outpost declaring a token authenticates against the authentik
server with the vault token instead of the blueprint's auto-generated
one. Drive both from a single rendered script over a target list.

Also raise the server healthcheck start_period to 120s: cold first boot
runs DB migrations plus app init (~90s observed), which tripped
compose --wait as unhealthy at the old 30s.

Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>

roles/authentik/templates/docker-compose.yml.j2

@@ -23,7 +23,9 @@ services:
     command: server
     healthcheck:
       test: ["CMD", "ak", "healthcheck"]
-      start_period: 30s
+      # Cold first boot runs DB migrations + app init (~90s observed);
+      # start_period must cover that or compose --wait trips unhealthy.
+      start_period: 120s
       interval: 10s
       retries: 5
       timeout: 5s

roles/authentik/templates/set-outpost-token.py.j2

@@ -1,10 +1,26 @@
 from authentik.outposts.models import Outpost
 from authentik.core.models import Token
-o = Outpost.objects.get(name='{{ authentik_ldap_outpost.name }}')
-t = Token.objects.get(identifier=o.token_identifier)
-if t.key != '{{ authentik_ldap_outpost.token }}':
-    t.key = '{{ authentik_ldap_outpost.token }}'
-    t.save(update_fields=['key'])
-    print('changed')
-else:
-    print('ok')
+
+# (outpost name, desired token key) for every outpost we pin a known
+# token on: the LDAP outpost plus any proxy outpost that declares a
+# `token` (co-located proxy outposts authenticate with it against the
+# authentik server).
+_targets = [
+{% if authentik_ldap_outpost.name is defined %}
+    ('{{ authentik_ldap_outpost.name }}', '{{ authentik_ldap_outpost.token }}'),
+{% endif %}
+{% for o in authentik_proxy_outposts | default([]) if o.token is defined %}
+    ('{{ o.name }}', '{{ o.token }}'),
+{% endfor %}
+]
+
+changed = False
+for name, key in _targets:
+    o = Outpost.objects.get(name=name)
+    t = Token.objects.get(identifier=o.token_identifier)
+    if t.key != key:
+        t.key = key
+        t.save(update_fields=['key'])
+        changed = True
+
+print('changed' if changed else 'ok')