web/admin: add secret management pages

[dominic-r]

Details

Part of the managed secrets stack, see #25415.

What does this PR change?

Adds System > Secrets to the Admin interface: the list of secrets with buttons to view or download, edit, rotate, and set permissions on each.

Why is this change needed?

Admins need one place to find, rotate, and permission the credentials authentik stores. See #25415.

How was this tested?

Used the page locally: opened the create form, rotated a secret, and opened the delete dialog for a secret in use, which lists the objects that block the deletion.

Linked issues

---

Checklist

• The project has been linted, built, and tested (make all)
• The documentation has been updated and formatted (make docs)
• I have read the AI usage policy.

[netlify]

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	8f4924a
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/6acaaaf33484ca00088a4367
😎 Deploy Preview	https://deploy-preview-26107--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
4741	1	4740	14

View the top 1 failed test(s) by shortest run time

600-providers.test.ts::Provider Wizard › Complete OAuth2 Provider

Stack Traces | 91.5s run time

Client Secret should be visible when Client Type is Confidential

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[github-actions]

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-b779c2ef3c6477cc63a80c6b1249a92af1d24e23
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-b779c2ef3c6477cc63a80c6b1249a92af1d24e23

Afterwards, run the upgrade commands from the latest release notes.