fix: Set invitation-only enrollment flow as default in brand

This ensures that when admins create invitations in the Authentik UI,
they automatically use the correct default-enrollment-flow instead of
the default-source-enrollment flow (which only works with external IdPs).

Changes:
- Added tenant configuration to set flow_enrollment
- Invitation URLs will now correctly use /if/flow/default-enrollment-flow/

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

ansible/roles/authentik/files/enrollment-flow.yaml

@@ -146,3 +146,10 @@ entries:
       stage: !KeyOf user-write-stage
       target: !KeyOf flow
     model: authentik_flows.flowstagebinding
+
+  # 10. SET AS DEFAULT ENROLLMENT FLOW IN BRAND
+  - attrs:
+      flow_enrollment: !KeyOf flow
+    identifiers:
+      domain: authentik-default
+    model: authentik_tenants.tenant