authentik: boot-persistent quadlet conversion with deploy handler

The compose-era authentik trio died at every boot (rootless podman does not
auto-start bare containers). Convert the trio to Quadlet units installed by
deploy-remote.sh into ~/.config/containers/systemd/, enabled + WantedBy=
default.target:

- 3 unit files under dankclaw/authentik/quadlet/ (postgres -> server -> worker
  ordering via Wants=/After=; secrets stay in the git-ignored host .env,
  expanded by systemd at start time exactly like the gitea units)
- deploy_authentik() handler: install units, daemon-reload, retire stale
  compose-era containers only while units are inactive, enable once, then
  start in dependency order with podman-health gates between stages
- compose.yaml: authentik service definitions retired to a comment pointing at
  the quadlet dir (same pattern as searxng/open-webui/gitea/caddy)
- tests/authentik.bats rewritten from compose assertions to unit-file
  contract assertions (images, Exec roles, ordering, loopback-only publish,
  pg_isready probe, secret hygiene, dispatch routing)

dankclaw/compose.yaml

@@ -246,69 +246,14 @@ services:
       retries: 3
 
   # --- Authentik (SSO / OIDC provider) -------------------------------------
-  # 3-service stack: PostgreSQL + server + worker. Redis was removed in
-  # 2025.10 (sessions/caching moved to PostgreSQL). The Caddyfile's
-  # forward_auth vhosts proxy to authentik-server:9000 (compose network).
+  # Now boot-persistent Quadlet units, not compose services: authentik-
+  # postgres -> authentik-server -> authentik-worker start in dependency order
+  # via ~/.config/containers/systemd/*.container on the host (repo source:
+  # dankclaw/authentik/quadlet/; deploy-remote.sh deploy_authentik installs
+  # and starts them). Redis was removed in 2025.10 (sessions/caching moved to
+  # PostgreSQL). The Caddyfile's forward_auth vhosts proxy to
+  # authentik-server:9000 over the dankclaw_default network (A2A DNS).
   # See ../docs/Infrastructure/Authentik.md.
-  authentik-postgres:
-    image: docker.io/library/postgres:16-alpine
-    container_name: authentik-postgres
-    restart: unless-stopped
-    environment:
-      POSTGRES_DB: authentik
-      POSTGRES_USER: authentik
-      POSTGRES_PASSWORD: ${AUTHENTIK_PG_PASS}
-    volumes:
-      - /home/dank/authentik/postgres:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -d authentik -U authentik"]
-      interval: 30s
-      retries: 5
-      start_period: 20s
-
-  authentik-server:
-    image: ghcr.io/goauthentik/server:2026.8.0
-    container_name: authentik-server
-    restart: unless-stopped
-    command: server
-    environment:
-      AUTHENTIK_POSTGRESQL__HOST: authentik-postgres
-      AUTHENTIK_POSTGRESQL__NAME: authentik
-      AUTHENTIK_POSTGRESQL__USER: authentik
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_PG_PASS}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
-    ports:
-      - "9000:9000"
-    volumes:
-      - /home/dank/authentik/data:/data
-    shm_size: 512mb
-    depends_on:
-      authentik-postgres:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:9000/-/health/')"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
-      start_period: 30s
-
-  authentik-worker:
-    image: ghcr.io/goauthentik/server:2026.8.0
-    container_name: authentik-worker
-    restart: unless-stopped
-    command: worker
-    environment:
-      AUTHENTIK_POSTGRESQL__HOST: authentik-postgres
-      AUTHENTIK_POSTGRESQL__NAME: authentik
-      AUTHENTIK_POSTGRESQL__USER: authentik
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_PG_PASS}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
-    user: "0:0"
-    volumes:
-      - /home/dank/authentik/data:/data
-    depends_on:
-      authentik-postgres:
-        condition: service_healthy
 
   # Caddy (the homelab's single reverse proxy) left compose on 2026-08-26:
   # it is boot-persistent via its Quadlet unit (dankclaw/caddy/quadlet/