Version-control the Authentik OIDC blueprint, add full-logout + username regression tests

The Authentik blueprint that provisions the OAuth2 Provider/Application only
lived on CT121's filesystem via ad-hoc scp/pct push -- deploy/authentik/ is
now the source of truth, with redeploy steps in docs/oidc-setup.md.

Also documents two bugs found and fixed while implementing issue #19: the
first RP-Initiated Logout attempt only ended the app-scoped session, and the
provider had no property_mappings so the ID token's username claim was
missing (fell back to a raw sub hash that looked like a leaked session
token). Both are covered by new Playwright regression tests.

The deep-check Fingerbank test now skips instead of failing when its target
device (192.168.1.106) has since been manually labeled known via the
dashboard, rather than assuming it stays unlabeled forever.

deploy/authentik/homelab-monitor-oidc.yaml

@@ -0,0 +1,55 @@
+version: 1
+metadata:
+  name: homelab-monitor-oidc
+entries:
+  - model: authentik_providers_oauth2.oauth2provider
+    id: homelab-monitor-provider
+    identifiers:
+      name: homelab-monitor
+    attrs:
+      client_type: confidential
+      client_id: 91e5b20f5902319144cc1530559f5c8ba27e0027
+      # Real secret lives only in CT122's .env / Vaultwarden -- this
+      # blueprint file as deployed to CT121 has the real value baked in
+      # (Authentik blueprints don't support secret refs), but the copy
+      # tracked in this repo uses a placeholder. If re-deploying from
+      # scratch, pull the real secret from Vaultwarden ("Homelab Monitor -
+      # Authentik OIDC client") and substitute it before pushing to CT121.
+      client_secret: __SEE_VAULTWARDEN_HOMELAB_MONITOR_OIDC_CLIENT__
+      authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      # default-invalidation-flow (full Authentik logout), not
+      # default-provider-invalidation-flow (app-scoped only). The app-scoped
+      # one leaves Authentik's own browser session cookie valid, so a
+      # subsequent "Sign in with Authentik" click silently re-authenticates
+      # with no prompt -- doesn't satisfy "sign out should sign out of
+      # Authentik too" (issue #19). Confirmed via a full Playwright
+      # click-through both ways before settling on this. Per-provider
+      # setting; doesn't affect any other app's logout behavior.
+      invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
+      signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
+      sub_mode: hashed_user_id
+      # Without these, the ID token only ever carries the bare required
+      # claims (sub/iss/aud/exp/...) -- never preferred_username or email.
+      # The app's claim fallback chain (preferred_username ?? email ?? sub)
+      # landed on the raw sub hash, which rendered next to the sign-out
+      # button looking like a leaked session token. Confirmed root cause by
+      # decoding a real captured ID token before concluding this was it,
+      # rather than guessing.
+      property_mappings:
+        - !Find [authentik_providers_oauth2.scopemapping, [name, "authentik default OAuth Mapping: OpenID 'openid'"]]
+        - !Find [authentik_providers_oauth2.scopemapping, [name, "authentik default OAuth Mapping: OpenID 'profile'"]]
+        - !Find [authentik_providers_oauth2.scopemapping, [name, "authentik default OAuth Mapping: OpenID 'email'"]]
+      redirect_uris:
+        - matching_mode: strict
+          url: https://monitor.jerodrigged.com/api/auth/oidc/callback
+        - matching_mode: strict
+          url: http://192.168.1.103:8090/api/auth/oidc/callback
+  - model: authentik_core.application
+    id: homelab-monitor-app
+    identifiers:
+      slug: homelab-monitor
+    attrs:
+      name: Homelab Monitor
+      provider: !KeyOf homelab-monitor-provider
+      open_in_new_tab: false
+      meta_launch_url: https://monitor.jerodrigged.com