stacks: add .env + .env.secrets.ctmpl for identity-and-security stacks

Adds the real Vault Agent secret-rendering templates and non-secret
env vars for authentik, vaultwarden, and wazuh - sanitized (real
domain/email/SMTP provider genericized, kv/<host>/... paths use a
generic 'host' placeholder instead of the real hostname). This is
the standing pattern for the rest of stacks/ going forward.

stacks/identity-and-security/authentik/.env

@@ -0,0 +1,19 @@
+AUTHENTIK_URL=https://authentik.local.example.com
+
+# Exposed HTTP port
+COMPOSE_PORT_HTTP=9000
+
+# Volume Home
+DOCKER=/path/to/docker_volumes
+
+AUTHENTIK_EMAIL__HOST=smtp.example.com
+AUTHENTIK_EMAIL__PORT=587
+AUTHENTIK_EMAIL__USERNAME=[email protected]
+AUTHENTIK_EMAIL__USE_TLS=true
+AUTHENTIK_EMAIL__USE_SSL=false
+AUTHENTIK_EMAIL__TIMEOUT=30
+AUTHENTIK_EMAIL__FROM=[email protected]
+
+# Database Configuration
+PG_USER=authentik
+PG_DB=authentik

stacks/identity-and-security/authentik/.env.secrets.ctmpl

@@ -0,0 +1,4 @@
+AUTHENTIK_SECRET_KEY={{ with secret "kv/host/authentik" }}{{ .Data.data.authentik_secret_key }}{{ end }}
+AUTHENTIK_EMAIL__PASSWORD={{ with secret "kv/host/authentik" }}{{ .Data.data.email_password }}{{ end }}
+POSTGRES_PASSWORD={{ with secret "kv/host/authentik" }}{{ .Data.data.pg_pass }}{{ end }}
+AUTHENTIK_POSTGRESQL__PASSWORD={{ with secret "kv/host/authentik" }}{{ .Data.data.pg_pass }}{{ end }}