Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.

Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.

stacks/authentik/scripts/setup-gitea-oauth.py

@@ -0,0 +1,24 @@
+"""Register Authentik as Gitea OAuth source (run on host: docker exec gitea ...)."""
+import subprocess
+import sys
+
+CLIENT_ID = sys.argv[1] if len(sys.argv) > 1 else ""
+CLIENT_SECRET = sys.argv[2] if len(sys.argv) > 2 else ""
+if not CLIENT_ID or not CLIENT_SECRET:
+    print("usage: setup-gitea-oauth.py <client_id> <client_secret>")
+    sys.exit(1)
+
+DISCOVERY = "https://auth.ginnoir.com/application/o/gitea/.well-known/openid-configuration"
+
+cmd = [
+    "docker", "exec", "-u", "git", "gitea", "gitea", "admin", "auth", "add-oauth",
+    "--name", "Authentik",
+    "--provider", "openidConnect",
+    "--key", CLIENT_ID,
+    "--secret", CLIENT_SECRET,
+    "--auto-discover-url", DISCOVERY,
+    "--scopes", "openid profile email",
+]
+print("running:", " ".join(cmd[:8]), "...")
+subprocess.run(cmd, check=True)
+print("gitea oauth source Authentik registered")