Add Authentik OIDC login as an additional sign-in option

Local auth stays the primary/always-available login (don't want to
lock out the saved admin password) — OIDC is additive, shown as a
second button when OIDC_ENABLED=true. Uses openid-client v6 with PKCE.

Authentik-side provider was set up via an authentik blueprint (its own
declarative automation, see docs/oidc-setup.md) rather than touching
any existing admin credentials.

Closes #12.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/oidc-setup.md

@@ -0,0 +1,41 @@
+# Authentik OIDC setup
+
+Local auth (bcrypt + session, the saved Vaultwarden password) is always available.
+When `OIDC_ENABLED=true`, the login page additionally shows a "Sign in with Authentik"
+button — this is additive, not a replacement, so the existing admin login keeps working.
+
+## How the Authentik side was provisioned
+
+No API token or admin credentials were needed. Authentik supports **blueprints** —
+declarative YAML files it applies automatically — so the OAuth2 Provider + Application
+were created via `/opt/authentik/blueprints-local/homelab-monitor-oidc.yaml` on CT121,
+picked up by the `worker` container on startup. This is purely additive: it doesn't
+touch any existing user, group, or admin credential.
+
+- Blueprint volume mount added to `/opt/authentik/docker-compose.yml` (backed up as
+  `docker-compose.yml.bak-homelab-monitor` before editing) for both `server` and `worker`.
+- Provider: confidential client, `default-provider-authorization-implicit-consent` flow
+  (auto-approve — reasonable for a single-user personal dashboard), signed with
+  Authentik's existing self-signed cert.
+- Redirect URI: `http://192.168.1.103:8090/api/auth/oidc/callback` (LAN-only for now;
+  will need a second redirect URI added once issue #13's public exposure lands).
+- Application slug: `homelab-monitor`.
+
+To change anything (redirect URI, flow, scopes), edit the blueprint file on CT121 and
+either wait for Authentik's file-watcher or `docker restart authentik-worker-1` — it
+re-applies on any change to the file.
+
+## API-side implementation
+
+`apps/api/src/auth/oidc.ts` uses `openid-client` v6 with PKCE + state, same self-signed
+TLS handling pattern as `collectors/proxmox.ts` (Authentik's cert is self-signed on the
+LAN too). Routes in `apps/api/src/routes/oidc.ts`:
+
+- `GET /api/auth/oidc/login` — redirects to Authentik's authorization endpoint
+- `GET /api/auth/oidc/callback` — exchanges the code, sets `req.session.username` from
+  the `preferred_username` (falls back to `email`, then `sub`) ID token claim
+
+## Credentials
+
+`OIDC_CLIENT_ID`/`OIDC_CLIENT_SECRET` are in CT122's `.env` and saved in Vaultwarden
+alongside the local admin login.