Persist TB-006 batch 2 media SSO and batch 1 auth fixes to the repo.

Media sites get Caddy forward_auth; Authentik scripts cover all proxy providers. BookStack OIDC and Plane admin routing fixes included, plus ops scripts for external auth on valhalla.

stacks/authentik/scripts/setup-batch1-oidc.py

@@ -1,13 +1,15 @@
 """Create OAuth2 providers for batch-1 apps with native SSO (ak shell: exec(open(...).read()))."""
 from authentik.core.models import Application
+from authentik.crypto.models import CertificateKeyPair
 from authentik.flows.models import Flow
 from authentik.outposts.models import Outpost
-from authentik.providers.oauth2.models import OAuth2Provider, RedirectURI, RedirectURIMatchingMode
+from authentik.providers.oauth2.models import OAuth2Provider, RedirectURI, RedirectURIMatchingMode, SubModes
 from authentik.providers.proxy.models import ProxyProvider
 
 AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
 INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")
 DEFAULT_MAPPINGS = OAuth2Provider.objects.get(name="famapp").property_mappings.all()
+SIGNING_KEY = CertificateKeyPair.objects.get(name="authentik Self-signed Certificate")
 
 # slug, provider name, redirect URI(s)
 OIDC_APPS = [
@@ -15,7 +17,6 @@ OIDC_APPS = [
     ("gitea", "gitea", ["https://gitea.ginnoir.com/user/oauth2/Authentik/callback"]),
     ("portainer", "portainer", ["https://portainer.ginnoir.com/"]),
     ("minio", "minio-console", ["https://minio.ginnoir.com/oauth_callback"]),
-    ("plane", "plane", ["https://plane.ginnoir.com/auth/oidc/callback/"]),
 ]
 
 native_slugs = []
@@ -25,6 +26,8 @@ for slug, pname, redirects in OIDC_APPS:
         defaults={
             "authorization_flow": AUTHZ,
             "invalidation_flow": INVALID,
+            "signing_key": SIGNING_KEY,
+            "sub_mode": SubModes.USER_UUID if slug == "bookstack" else SubModes.HASHED_USER_ID,
             "redirect_uris": [
                 RedirectURI(matching_mode=RedirectURIMatchingMode.STRICT, url=url)
                 for url in redirects
@@ -60,7 +63,6 @@ PROXY_NAMES = {
     "gitea": "homelab-gitea",
     "portainer": "homelab-portainer",
     "minio": "homelab-minio",
-    "plane": "homelab-plane",
 }
 outpost = Outpost.objects.get(name="authentik Embedded Outpost")
 for slug in native_slugs: