Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.

Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.

stacks/authentik/scripts/configure-portainer-oauth.py

@@ -0,0 +1,45 @@
+"""Configure Portainer OAuth via API (run on valhalla with admin JWT)."""
+import json
+import sys
+import urllib.error
+import urllib.request
+
+JWT = sys.argv[1] if len(sys.argv) > 1 else ""
+CLIENT_ID = sys.argv[2] if len(sys.argv) > 2 else ""
+CLIENT_SECRET = sys.argv[3] if len(sys.argv) > 3 else ""
+if not JWT or not CLIENT_ID or not CLIENT_SECRET:
+    print("usage: configure-portainer-oauth.py <admin_jwt> <client_id> <client_secret>")
+    sys.exit(1)
+
+BASE = "http://localhost:9100/api"
+AUTH = "https://auth.ginnoir.com/application/o"
+
+payload = {
+    "AuthenticationMethod": 3,
+    "OAuthSettings": {
+        "ClientID": CLIENT_ID,
+        "ClientSecret": CLIENT_SECRET,
+        "AuthorizationURI": f"{AUTH}/authorize/",
+        "AccessTokenURI": f"{AUTH}/token/",
+        "ResourceURI": f"{AUTH}/userinfo/",
+        "RedirectURI": "https://portainer.ginnoir.com/",
+        "LogoutURI": f"{AUTH}/portainer/end-session/",
+        "UserIdentifier": "email",
+        "Scopes": "openid email profile",
+        "OAuthAutoCreateUsers": True,
+        "DefaultTeamID": 0,
+    },
+}
+
+req = urllib.request.Request(
+    f"{BASE}/settings",
+    data=json.dumps(payload).encode(),
+    headers={"Authorization": f"Bearer {JWT}", "Content-Type": "application/json"},
+    method="PUT",
+)
+try:
+    with urllib.request.urlopen(req) as resp:
+        print("portainer oauth configured:", resp.status)
+except urllib.error.HTTPError as e:
+    print("error:", e.code, e.read().decode())
+    sys.exit(1)