lifecycle: only create tenant media root if needed (#10616) Co-authored-by: Jens L. <jens@goauthentik.io>