Persist TB-006 batch 2 media SSO and batch 1 auth fixes to the repo.

Media sites get Caddy forward_auth; Authentik scripts cover all proxy providers. BookStack OIDC and Plane admin routing fixes included, plus ops scripts for external auth on valhalla.

stacks/dev/docker-compose.yml

@@ -147,12 +147,11 @@ services:
       - DB_PASS=${BOOKSTACK_DB_PASSWORD}
       - DB_DATABASE=bookstack
       - AUTH_METHOD=oidc
-      - AUTH_AUTO_INITIATE=true
+      - AUTH_AUTO_INITIATE=false
       - OIDC_NAME=Authentik
-      - OIDC_CLIENT_ID=${BOOKSTACK_OIDC_CLIENT_ID}
-      - OIDC_CLIENT_SECRET=${BOOKSTACK_OIDC_CLIENT_SECRET}
       - OIDC_ISSUER=https://auth.ginnoir.com/application/o/bookstack/
       - OIDC_ISSUER_DISCOVER=true
+      - OIDC_END_SESSION_ENDPOINT=true
     volumes:
       - /config/bookstack:/config
     ports:
@@ -197,6 +196,23 @@ services:
       - NEXT_PUBLIC_API_BASE_URL=https://plane.ginnoir.com
       - HOSTNAME=0.0.0.0
 
+  plane-admin:
+    container_name: plane_admin
+    image: makeplane/plane-admin:v0.23.1
+    restart: unless-stopped
+    networks: [dev, edge]
+    command: node admin/server.js
+    env_file:
+      - stack.env
+    environment:
+      - NEXT_PUBLIC_API_BASE_URL=https://plane.ginnoir.com
+      - HOSTNAME=0.0.0.0
+    depends_on:
+      plane-api:
+        condition: service_started
+      plane-web:
+        condition: service_started
+
   plane-api:
     container_name: plane_api
     image: makeplane/plane-backend:latest