Single Sign-On for the Home Lab with Authentik

Putting every home lab service behind one login with Authentik — Traefik forward-auth for apps without native SSO, OIDC for the rest, and all of it declared in Git.