Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.

Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.

stacks/authentik/scripts/apply-forward-auth-admin.py

@@ -1,5 +1,9 @@
 #!/usr/bin/env python3
-"""Apply TB-006 batch 1 proxy providers via authentik ORM (run: ak shell < script)."""
+"""Apply TB-006 batch 1 forward_auth proxy providers (forward_auth-only sites).
+
+Native OAuth/OIDC apps (bookstack, gitea, portainer, minio, plane, homarr) use
+setup-batch1-oidc.py instead. Run this via: ak shell -c exec(open(...).read())
+"""
 from authentik.core.models import Application
 from authentik.flows.models import Flow
 from authentik.outposts.models import Outpost, OutpostType
@@ -8,33 +12,38 @@ from authentik.providers.proxy.models import ProxyMode, ProxyProvider
 AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
 INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")
 
+UPTIME_UNAUTH = """^/status/.*
+^/assets/.*
+^/api/push/.*
+^/api/badge/.*
+^/api/status-page/heartbeat/.*
+^/icon.svg
+^/upload/.*"""
+
 SITES = [
-    ("homelab-portainer", "portainer", "Portainer", "https://portainer.ginnoir.com"),
-    ("homelab-code", "code", "code-server", "https://code.ginnoir.com"),
-    ("homelab-registry-ui", "registry-ui", "Registry UI", "https://registry-ui.ginnoir.com"),
-    ("homelab-vault", "vault", "Vault", "https://vault.ginnoir.com"),
-    ("homelab-minio", "minio", "MinIO Console", "https://minio.ginnoir.com"),
-    ("homelab-homarr", "homarr", "Homarr", "https://homarr.ginnoir.com"),
-    ("homelab-uptime", "uptime", "Uptime Kuma", "https://uptime.ginnoir.com"),
-    ("homelab-backup", "backup", "Kopia", "https://backup.ginnoir.com"),
-    ("homelab-gitea", "gitea", "Gitea", "https://gitea.ginnoir.com"),
-    ("homelab-dbx", "dbx", "DBX", "https://dbx.ginnoir.com"),
-    ("homelab-bookstack", "bookstack", "BookStack", "https://docs.ginnoir.com"),
-    ("homelab-plane", "plane", "Plane", "https://plane.ginnoir.com"),
+    ("homelab-code", "code", "code-server", "https://code.ginnoir.com", None, None),
+    ("homelab-registry-ui", "registry-ui", "Registry UI", "https://registry-ui.ginnoir.com", None, None),
+    ("homelab-vault", "vault", "Vault", "https://vault.ginnoir.com", None, None),
+    ("homelab-uptime", "uptime", "Uptime Kuma", "https://uptime.ginnoir.com", "http://uptime-kuma:3001", UPTIME_UNAUTH),
+    ("homelab-backup", "backup", "Kopia", "https://backup.ginnoir.com", None, None),
+    ("homelab-dbx", "dbx", "DBX", "https://dbx.ginnoir.com", None, None),
 ]
 
 providers = []
-for pname, slug, aname, host in SITES:
-    provider, _ = ProxyProvider.objects.update_or_create(
-        name=pname,
-        defaults={
-            "mode": ProxyMode.FORWARD_SINGLE,
-            "external_host": host,
-            "authorization_flow": AUTHZ,
-            "invalidation_flow": INVALID,
-            "intercept_header_auth": True,
-        },
-    )
+for pname, slug, aname, host, internal, unauth in SITES:
+    defaults = {
+        "mode": ProxyMode.FORWARD_SINGLE,
+        "external_host": host,
+        "authorization_flow": AUTHZ,
+        "invalidation_flow": INVALID,
+        "intercept_header_auth": True,
+    }
+    if internal:
+        defaults["internal_host"] = internal
+    if unauth:
+        defaults["skip_path_regex"] = unauth
+
+    provider, _ = ProxyProvider.objects.update_or_create(name=pname, defaults=defaults)
     Application.objects.update_or_create(
         slug=slug,
         defaults={