deploy: map authentik quadlet units to their own services

The quadlet-dir allowlist silently dropped every change under
dankclaw/authentik/ — the new outpost unit (and its siblings) now route
by exact unit name, mirroring the searxng/gitea pattern. Adds
authentik-outpost to the service inventories; it is a quadlet unit, not
a compose service, so it stays out of the compose set.

scripts/deploy-plan.py

@@ -39,6 +39,7 @@ SERVICE_ORDER = (
     "authentik-postgres",
     "authentik-server",
     "authentik-worker",
+    "authentik-outpost",
     "caddy",
     "homepage",
     "mariadb",
@@ -78,6 +79,7 @@ DANKCLAW_SERVICES = {
     "authentik-postgres",
     "authentik-server",
     "authentik-worker",
+    "authentik-outpost",
     "caddy",
     "homepage",
     "frank-default-large",
@@ -249,6 +251,11 @@ def services_for_path(path: str, target: str) -> set[str]:
         if len(parts) >= 2 and parts[1] in {"caddy", "comfyui", "loki", "alloy", "hermes", "anubis"}:
             _add(services, parts[1])
             return services
+        if len(parts) >= 4 and parts[1] == "authentik" and parts[2] == "quadlet":
+            name = parts[3].removesuffix(".container")
+            if name in {"authentik-postgres", "authentik-server", "authentik-worker", "authentik-outpost"}:
+                _add(services, name)
+            return services
         if len(parts) >= 2 and parts[1] == "searxng":
             if len(parts) >= 4 and parts[2] == "quadlet":
                 name = parts[3]