feat: add Authentik access widgets

frontend/src/pages/service-tabs/__tests__/UsersTab.test.tsx

@@ -15,22 +15,28 @@ const instance: ServiceInstance = {
 };
 
 vi.mock("../../../hooks/useAuthentik", () => ({
-	useAuthentikUsers: vi.fn(() => ({
+	useAuthentikAccessSummary: vi.fn(() => ({
 		data: {
 			items: [
 				{
-					pk: 1,
+					id: "1",
 					username: "alice",
 					name: "Alice",
 					email: "alice@example.com",
 					is_active: true,
+					is_superuser: true,
+					is_staff: false,
+					groups: [{ id: "admins", name: "Admins", known: true }],
 				},
 				{
-					pk: 2,
+					id: "2",
 					username: "bob",
 					name: "Bob",
 					email: "bob@example.com",
 					is_active: false,
+					is_superuser: false,
+					is_staff: true,
+					groups: [{ id: "gone", name: "Unknown group (gone)", known: false }],
 				},
 			],
 			total: 2,
@@ -42,13 +48,17 @@ vi.mock("../../../hooks/useAuthentik", () => ({
 }));
 
 describe("UsersTab", () => {
-	it("renders the directory table with users", () => {
+	it("renders group membership and explicit privilege metadata", () => {
 		render(<UsersTab instance={instance} />);
 		expect(screen.getByText("Alice")).toBeInTheDocument();
 		expect(screen.getByText("bob")).toBeInTheDocument();
-		expect(screen.getByText("alice@example.com")).toBeInTheDocument();
-		expect(screen.getByText("Active")).toBeInTheDocument();
-		expect(screen.getByText("Inactive")).toBeInTheDocument();
+		expect(screen.getByText("Admins")).toBeInTheDocument();
+		expect(screen.getByText("Unknown group (gone)")).toBeInTheDocument();
+		expect(screen.getByText("Superuser")).toBeInTheDocument();
+		expect(screen.getByText("Staff")).toBeInTheDocument();
+		expect(
+			screen.getByText(/not a complete effective-authorization calculation/i),
+		).toBeInTheDocument();
 	});
 
 	it("renders search input and pagination", () => {