Docs: git-admins claim with Authentik group nesting

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

CommunityDiscordMedia.md

@@ -258,7 +258,8 @@ Same pattern as Jellyfin: Authentik is the identity, Gitea trusts it.
 - [x] Gitea env: `DISABLE_REGISTRATION=false` + `ALLOW_ONLY_EXTERNAL_REGISTRATION=true` (local self-signup stays
       off), `ENABLE_AUTO_REGISTRATION`, `ACCOUNT_LINKING=auto`, `USERNAME=nickname`, `UPDATE_AVATAR`
 - [ ] optional: hide the password form on the login page (custom template) so Discord is the only visible way in
-- [ ] Authentik group `git-users` (from a Discord role) bound on the `Gitea` application (+ `admins`); only they can log in
+- [ ] Authentik groups `git-users` and `git-admins` bound on the `Gitea` application; Gitea admin claim = `git-admins`;
+      nesting `authentik Admins` → `admins` → `git-admins` so admins inherit it
 - [ ] test with a non-admin Discord user; confirm admin mapping via `admins` group
 
 ### Phase 11 — MediaMTX auth through Authentik (no stream keys anywhere)  ✅ live