authentik: fix quadlet v1 generator dialect on this host

Probed the live generator on dankclaw: podman 5.x v1 hard-fails unit
generation on dash-prefixed options (--shm-size killed authentik-server's
unit) and rejects Command= entirely; Exec= is the accepted role selector.
Drop --shm-size (uwsgi uses unix sockets under /run, not /dev/shm; default
64m shm is fine) and drop systemctl --user enable — generated units are
transient and cannot be enabled; WantedBy=default.target in each unit file
is what makes them boot-persistent on this generator.

dankclaw/authentik/quadlet/authentik-server.container

@@ -30,7 +30,6 @@ Environment=AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_PG_PASS}
 Environment=AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
 PublishPort=127.0.0.1:9000:9000
 HealthCmd=python -c "import urllib.request;urllib.request.urlopen('http://localhost:9000/-/health/')"
---shm-size=512m
 HealthInterval=30s
 HealthTimeout=10s
 HealthRetries=5

scripts/deploy-remote.sh

@@ -537,7 +537,12 @@ deploy_authentik() {
         podman stop authentik-postgres authentik-server authentik-worker 2>/dev/null || true
         podman rm authentik-postgres authentik-server authentik-worker 2>/dev/null || true
     fi
-    systemctl --user enable authentik-postgres.service authentik-server.service authentik-worker.service
+    # No `systemctl --user enable` here: this host's quadlet generator
+    # (podman 5.x v1) generates units into /run/user/1000/systemd/generator/,
+    # and generated units cannot be enabled — enable fails with "transient or
+    # generated". Boot persistence comes from [Install] WantedBy=default.target
+    # inside each .container file, which the generator honors at user-manager
+    # start (linger must stay on for the deploy user).
     systemctl --user start authentik-postgres.service
     wait_container_healthy authentik-postgres 120 || return 1
     systemctl --user start authentik-server.service