root: move database calls from ready() to dedicated startup signal

[BeryJu]

Details

This started out as an attempt to get rid of the Django 5.x deprecation message saying to not do database calls in the AppConfig's ready() call.

The PR introduces a couple new signals for startup logic, and the signals are triggered by either the dev_server command or gunicorn's post_worker_init hook. To not change too much of the startup logic, the ManagedAppConfig connects to those new signals to call its startup reconcilers.

There's also an optimisation in this PR; for gunicorn the signal is only triggered for the first worker as all required things such as importing modules is not handled by this signal, and thus it is enough to know that the startup reconcilers were triggered once per gunicorn process.

There's also a nice side-effect of speeding up the startup as startup tasks are no longer run when migrating

---

Checklist

• Local tests pass (ak test authentik/)
• The code has been formatted (make lint-fix)

If an API change has been made

• The API schema has been updated (make gen-build)

If changes to the frontend have been made

• The code has been formatted (make web)

If applicable

• The documentation has been updated
• The documentation has been formatted (make website)

[netlify]

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	7c692bb
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/660bf155a0e0f10008430e61
😎 Deploy Preview	https://deploy-preview-9081--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[netlify]

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	7c692bb
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/660bf155f7aa9d0008222f12
😎 Deploy Preview	https://deploy-preview-9081--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[github-actions]

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ghcr.io/goauthentik/dev-server:gh-7c692bb652cb03e73df0377a845c8f26e8bb92e4
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

For arm64, use these values:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ghcr.io/goauthentik/dev-server:gh-7c692bb652cb03e73df0377a845c8f26e8bb92e4-arm64
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
image:
    repository: ghcr.io/goauthentik/dev-server
    tag: gh-ghcr.io/goauthentik/dev-server:gh-7c692bb652cb03e73df0377a845c8f26e8bb92e4

For arm64, use these values:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
image:
    repository: ghcr.io/goauthentik/dev-server
    tag: gh-ghcr.io/goauthentik/dev-server:gh-7c692bb652cb03e73df0377a845c8f26e8bb92e4-arm64

Afterwards, run the upgrade commands from the latest release notes.