Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.

Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.

stacks/authentik/scripts/disable-uptime-auth.py

@@ -0,0 +1,15 @@
+"""Disable Uptime Kuma local auth (forward_auth is the gate)."""
+import sqlite3
+import sys
+
+DB = sys.argv[1] if len(sys.argv) > 1 else "/config/uptime-kuma/kuma.db"
+
+conn = sqlite3.connect(DB)
+cur = conn.cursor()
+cur.execute(
+    "INSERT INTO setting (key, value) VALUES ('disableAuth', '1') "
+    "ON CONFLICT(key) DO UPDATE SET value='1'"
+)
+conn.commit()
+conn.close()
+print(f"disableAuth=1 in {DB}")