Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.

Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.

stacks/dev/docker-compose.yml

@@ -82,11 +82,11 @@ services:
       - PUID=1000
       - PGID=1000
       - TZ=${TZ}
-      - PASSWORD=${CODE_SERVER_PASSWORD}
-      - SUDO_PASSWORD=${CODE_SERVER_PASSWORD}
       - DEFAULT_WORKSPACE=/workspace
+      # Authentik forward_auth at the edge — local password auth disabled via config mount.
     volumes:
       - /config/code-server:/config
+      - /config/code-server/code-server.yaml:/config/.config/code-server/config.yaml
       - /home/ginnoir:/workspace
     ports:
       - "8443:8443"
@@ -146,6 +146,13 @@ services:
       - DB_USER=bookstack
       - DB_PASS=${BOOKSTACK_DB_PASSWORD}
       - DB_DATABASE=bookstack
+      - AUTH_METHOD=oidc
+      - AUTH_AUTO_INITIATE=true
+      - OIDC_NAME=Authentik
+      - OIDC_CLIENT_ID=${BOOKSTACK_OIDC_CLIENT_ID}
+      - OIDC_CLIENT_SECRET=${BOOKSTACK_OIDC_CLIENT_SECRET}
+      - OIDC_ISSUER=https://auth.ginnoir.com/application/o/bookstack/
+      - OIDC_ISSUER_DISCOVER=true
     volumes:
       - /config/bookstack:/config
     ports: