authentik: require flows + application on proxy providers; harden SSO e2e

The loki/grafana/seerr proxy providers were script-provisioned with no
flows and no Application: null flows made the embedded outpost's Rust
deserializer reject the whole config (all guarded vhosts down after any
outpost reload), and the missing apps bounced post-login to authentik's
user UI instead of the app. Backfilled both live; documented the two
provisioning rules and updated the provider inventory. SSO e2e now
asserts the app landing (pathname leaves /if/, no IdP markers in body)
instead of only the hostname.

tests/e2e/specs/13-sso.spec.ts

@@ -23,8 +23,15 @@ for (const vhost of GUARDED) {
     await expect
       .poll(() => new URL(page.url()).hostname, { timeout: 60_000 })
       .toBe(new URL(vhost).hostname);
+    // A bounce to authentik's UI would satisfy the hostname assert above (the
+    // outpost serves /if/flow on the guarded vhost itself), so require the
+    // path to have left authentik's namespace and the page to not be the IdP.
+    await expect
+      .poll(() => new URL(page.url()).pathname.startsWith("/if/"), { timeout: 60_000 })
+      .toBe(false);
     const body = await page.locator("body").innerText();
-    expect(body).not.toContain("Sign in"); // authentik identification stage
+    expect(body).not.toContain("Powered by authentik"); // authentik flow shell
+    expect(body).not.toContain("Sign in"); // generic login form
     expect(body).not.toContain("Making sure you're not a bot");
     const resp = await page.request.get(page.url());
     expect(resp.status()).toBeLessThan(500);