docs(authentik,openwebui): the roles claim mints the OpenWebUI role

Provisioned jason (pk 24, human-user template) and drove his first SSO
login in a clean browser: the row appeared as role='user' with chat and
wilwheaton TTS working, no manual step. The pending-then-flip law is
therefore wrong for a claim-carrying account - ENABLE_OAUTH_ROLE_MANAGEMENT
+ the roles scope decide it, and 0.12.5 refuses a claim-less login with 403
instead of falling back to ui.default_user_role. Census gains jason.

serverAppConfigs-docs/Infrastructure/Authentik.md

@@ -393,9 +393,10 @@ downstream —
 - `Non-Admin Users` = the plain-user marker group (precedents: qa-e2e, and
   every human account).
 - **The human-user template** (ridley, kassie, alex, artem, kirby, ry, nic,
-  debo, freya, mitch, eric). The pks in this page are confirmed against
-  `authentik_core_user` on 2026-10-18: ridley 13, kassie 14, alex 15,
-  artem 16, kirby 17, ry 18, nic 19, debo 20, freya 21, mitch 22, eric 23 —
+  debo, freya, mitch, eric, jason). The pks were confirmed against
+  `authentik_core_user` on 2026-10-18 and the table re-read 2026-11-04: ridley
+  13, kassie 14, alex 15, artem 16, kirby 17, ry 18, nic 19, debo 20, freya 21,
+  mitch 22, eric 23, **jason 24 (created 2026-11-04)** —
   and every one carries the `<user>@franksdank.cloud` address the template
   prescribes. Creation dates (2026-10-07 → 2026-10-15) were not re-checked
   - (unverified 2026-10-18)*. Template: `username` +