Docs: git-admins claim with Authentik group nesting

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -212,11 +212,13 @@ Keep repo write access to trusted people.
 2. Gitea → Site Administration → Identity & Access → Authentication Sources → Add: type **OAuth2**, name
    **`authentik`** (must match the callback path), provider **OpenID Connect**, client ID/secret, OpenID Connect
    Auto Discovery URL `https://auth.HOST/application/o/gitea/.well-known/openid-configuration`, tick "Skip local
-   2FA", claim name for groups `groups`, administrator group claim value `admins`. Save.
+   2FA", claim name for groups `groups`, administrator group claim value **`git-admins`**. Save.
+   Authentik group nesting makes the admins inherit it: `authentik Admins` → parent `admins` → parent `git-admins`
+   (members of a child group count as members of the parent, in the `groups` claim and in Caddy's header checks).
 3. compose (already set): registration only via external sources, auto-registration + account linking on,
    username from `preferred_username`. A first Discord login creates the Gitea user with no form.
 4. Access = Authentik group **`git-users`**: Directory → Groups → create it (add a Discord role to it in the
-   roles→groups table); Applications → `Gitea` → Policy / Group / User Bindings → bind `git-users` (and `admins`).
+   roles→groups table); Applications → `Gitea` → Policy / Group / User Bindings → bind `git-users` and `git-admins`.
    Non-members are refused by Authentik before Gitea sees them.
 5. Test in a private window: https://git.HOST/user/login → "Sign in with authentik" → Discord → logged in.
    Members of `admins` become Gitea site admins on login. The local admin account stays as a fallback.