Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.

Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.

stacks/dev/code-server.yaml

@@ -0,0 +1,3 @@
+bind-addr: 0.0.0.0:8443
+auth: none
+cert: false

stacks/dev/docker-compose.yml

@@ -82,11 +82,11 @@ services:
       - PUID=1000
       - PGID=1000
       - TZ=${TZ}
-      - PASSWORD=${CODE_SERVER_PASSWORD}
-      - SUDO_PASSWORD=${CODE_SERVER_PASSWORD}
       - DEFAULT_WORKSPACE=/workspace
+      # Authentik forward_auth at the edge — local password auth disabled via config mount.
     volumes:
       - /config/code-server:/config
+      - /config/code-server/code-server.yaml:/config/.config/code-server/config.yaml
       - /home/ginnoir:/workspace
     ports:
       - "8443:8443"
@@ -146,6 +146,13 @@ services:
       - DB_USER=bookstack
       - DB_PASS=${BOOKSTACK_DB_PASSWORD}
       - DB_DATABASE=bookstack
+      - AUTH_METHOD=oidc
+      - AUTH_AUTO_INITIATE=true
+      - OIDC_NAME=Authentik
+      - OIDC_CLIENT_ID=${BOOKSTACK_OIDC_CLIENT_ID}
+      - OIDC_CLIENT_SECRET=${BOOKSTACK_OIDC_CLIENT_SECRET}
+      - OIDC_ISSUER=https://auth.ginnoir.com/application/o/bookstack/
+      - OIDC_ISSUER_DISCOVER=true
     volumes:
       - /config/bookstack:/config
     ports:

stacks/dev/stack.env

@@ -12,6 +12,8 @@ CODE_SERVER_PASSWORD=c0de_s3rver_pass
 BOOKSTACK_APP_KEY=base64:cSR6L4TPEbM2IFi9MyZcnmexvzAlIHAjn/qMzQKO/t4=
 BOOKSTACK_DB_PASSWORD=bookstack_d3v_pass
 BOOKSTACK_DB_ROOT_PASSWORD=bookstack_r00t_pass
+BOOKSTACK_OIDC_CLIENT_ID=8YV4BI2JVIG1QzS2DbylEgqv56sgfiOVRXOgw2Z5
+BOOKSTACK_OIDC_CLIENT_SECRET=wIyiw7LmGBORDyTdc2crSZryXJHzIq4gtajAKSpOU7e8BkBSO6SstM9gGPrnp4tbJhCFSQggYAgtYd5LOjUvQpSWInzm0JLlmLg1BTlPq5EVVieNYuWRCCQrerj8gRZ0
 
 # Plane project management
 # Rotate with: openssl rand -hex 32