Persist TB-006 batch 2 media SSO and batch 1 auth fixes to the repo.

Media sites get Caddy forward_auth; Authentik scripts cover all proxy providers. BookStack OIDC and Plane admin routing fixes included, plus ops scripts for external auth on valhalla.

stacks/dev/docker-compose.yml

@@ -147,12 +147,11 @@ services:
       - DB_PASS=${BOOKSTACK_DB_PASSWORD}
       - DB_DATABASE=bookstack
       - AUTH_METHOD=oidc
-      - AUTH_AUTO_INITIATE=true
+      - AUTH_AUTO_INITIATE=false
       - OIDC_NAME=Authentik
-      - OIDC_CLIENT_ID=${BOOKSTACK_OIDC_CLIENT_ID}
-      - OIDC_CLIENT_SECRET=${BOOKSTACK_OIDC_CLIENT_SECRET}
       - OIDC_ISSUER=https://auth.ginnoir.com/application/o/bookstack/
       - OIDC_ISSUER_DISCOVER=true
+      - OIDC_END_SESSION_ENDPOINT=true
     volumes:
       - /config/bookstack:/config
     ports:
@@ -197,6 +196,23 @@ services:
       - NEXT_PUBLIC_API_BASE_URL=https://plane.ginnoir.com
       - HOSTNAME=0.0.0.0
 
+  plane-admin:
+    container_name: plane_admin
+    image: makeplane/plane-admin:v0.23.1
+    restart: unless-stopped
+    networks: [dev, edge]
+    command: node admin/server.js
+    env_file:
+      - stack.env
+    environment:
+      - NEXT_PUBLIC_API_BASE_URL=https://plane.ginnoir.com
+      - HOSTNAME=0.0.0.0
+    depends_on:
+      plane-api:
+        condition: service_started
+      plane-web:
+        condition: service_started
+
   plane-api:
     container_name: plane_api
     image: makeplane/plane-backend:latest

stacks/dev/stack.env

@@ -14,6 +14,9 @@ BOOKSTACK_DB_PASSWORD=bookstack_d3v_pass
 BOOKSTACK_DB_ROOT_PASSWORD=bookstack_r00t_pass
 BOOKSTACK_OIDC_CLIENT_ID=8YV4BI2JVIG1QzS2DbylEgqv56sgfiOVRXOgw2Z5
 BOOKSTACK_OIDC_CLIENT_SECRET=wIyiw7LmGBORDyTdc2crSZryXJHzIq4gtajAKSpOU7e8BkBSO6SstM9gGPrnp4tbJhCFSQggYAgtYd5LOjUvQpSWInzm0JLlmLg1BTlPq5EVVieNYuWRCCQrerj8gRZ0
+# BookStack reads OIDC_* directly (env_file); BOOKSTACK_* kept for Portainer UI mirror if using ${} in compose.
+OIDC_CLIENT_ID=8YV4BI2JVIG1QzS2DbylEgqv56sgfiOVRXOgw2Z5
+OIDC_CLIENT_SECRET=wIyiw7LmGBORDyTdc2crSZryXJHzIq4gtajAKSpOU7e8BkBSO6SstM9gGPrnp4tbJhCFSQggYAgtYd5LOjUvQpSWInzm0JLlmLg1BTlPq5EVVieNYuWRCCQrerj8gRZ0
 
 # Plane project management
 # Rotate with: openssl rand -hex 32