feat: add authentik admin user sync endpoint

backend/README.md

@@ -29,6 +29,13 @@ python scripts/generate_api_key_hash.py 'YOUR_PLAIN_KEY'
 - Optional:
   - `AUTHENTIK_AUDIENCE` (enables audience claim validation)
 
+## Authentik Admin API setup
+
+- Required for `/internal/authentik/users/ensure`:
+  - `AUTHENTIK_BASE_URL`
+  - `AUTHENTIK_ADMIN_TOKEN`
+  - `AUTHENTIK_VERIFY_TLS`
+
 ## Main APIs
 
 - `GET /healthz`
@@ -36,5 +43,6 @@ python scripts/generate_api_key_hash.py 'YOUR_PLAIN_KEY'
 - `GET /me/permissions/snapshot` (Bearer token required)
 - `POST /internal/users/upsert-by-sub`
 - `GET /internal/permissions/{authentik_sub}/snapshot`
+- `POST /internal/authentik/users/ensure`
 - `POST /admin/permissions/grant`
 - `POST /admin/permissions/revoke`