Complete TB-006 batch 1 SSO so admin apps use Authentik without double login.

Native OAuth/OIDC for Homarr, BookStack, Gitea, and MinIO console; forward_auth with local auth disabled for code-server, uptime, and kopia; Caddy and Authentik scripts updated to match.

stacks/monitoring/docker-compose.yml

@@ -21,6 +21,8 @@ services:
     networks: [edge]
     env_file:
       - stack.env
+    environment:
+      - BASE_URL=https://homarr.ginnoir.com
     ports:
       - "7575:7575"
     volumes:

stacks/monitoring/stack.env

@@ -1,3 +1,19 @@
 # monitoring stack secrets — injected via env_file; container-exact var names.
 # Homarr config encryption key. Generate with: openssl rand -hex 32
 SECRET_ENCRYPTION_KEY=98989838bf06c9e42d77944ce848963a22ab316b55a09b0d199652ef0934394f
+# Auth.js session/state signing — required for OIDC (openssl rand -base64 32)
+AUTH_SECRET=7Kp2mN9xQvR4sT6wY8zA1bC3dE5fG0hJ2kL4nM6pS8uV0xZ=
+
+# Homarr native OIDC via Authentik (replaces forward_auth + credentials login)
+AUTH_PROVIDERS=oidc
+AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/homarr/
+AUTH_OIDC_CLIENT_ID=u5XiQcEenMoo3cViXOw3OWt644m2AMsbUXNpInqu
+AUTH_OIDC_CLIENT_SECRET=PTnXULynOv7HreiqnCmAWOc9vy81gyA57NIS7rxJnBc8g6WeD7fo4d5kWoK54U3QodMrTXVAtT6GoTcqJznEONQDzeZXGe25fZAbcQNtOdgpLakoLKHP1aVU2jJ2nkOR
+AUTH_OIDC_CLIENT_NAME=Authentik
+AUTH_OIDC_AUTO_LOGIN=true
+AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING=true
+AUTH_OIDC_SCOPE_OVERWRITE=openid email profile
+AUTH_OIDC_GROUPS_ATTRIBUTE=groups
+AUTH_OIDC_FORCE_USERINFO=true
+AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE=name
+AUTH_LOGOUT_REDIRECT_URL=https://auth.ginnoir.com/application/o/homarr/end-session/