open-webui: SSO via authentik (OIDC authorization-code flow)

- quadlet: OAUTH_*/OPENID_* env + EnvironmentFile for the client secret
  (secret stays off-repo in /home/dank/Containers/open-webui/env, mode 600)
- authentik objects created live: application 'open-webui', OAuth2 provider
  'Open WebUI' (Strict redirect URI), 'Open WebUI roles' scope mapping,
  entitlements Open WebUI Users/Admins bound to openwebui_users/admins
- e2e: 18-openwebui-sso.spec.ts (silent SSO round-trip) + prefix in config
- unit tests: OIDC wiring + secret-hygiene assertions
- docs: SSO section + history entry

dankclaw/open-webui/quadlet/open-webui.container

@@ -33,6 +33,28 @@ Environment=OPENAI_API_BASE_URL=http://192.168.0.143:7770
 Environment=ANONYMIZED_TELEMETRY=False
 Environment=DO_NOT_TRACK=True
 
+# SSO via authentik (OIDC authorization-code flow, 2026-09-24). The OAuth
+# client (application slug "open-webui") lives in authentik; the client
+# SECRET stays off-repo in the git-ignored host env file (mode 600). The
+# container reaches the IdP over the public URL: Caddy publishes 0.0.0.0:443
+# and Pi-hole resolves auth.franksdank.cloud to the host LAN IP, so the
+# server-side code exchange works from this bridge. Roles come from the
+# "Open WebUI roles" scope mapping (entitlements "Open WebUI Users" /
+# "Open WebUI Admins"); OAUTH_MERGE_ACCOUNTS_BY_EMAIL folds SSO logins into
+# the existing local account (frank8465@protonmail.com). These vars SEED the
+# per-key config DB on first run (fill-missing only); on the live data dir
+# the Admin Panel is authoritative.
+EnvironmentFile=/home/dank/Containers/open-webui/env
+Environment=OAUTH_CLIENT_ID=KmtzKc0bjWjaIFeM0puYudI1CLXR2p0jnPCSf4N0
+Environment=OAUTH_PROVIDER_NAME=authentik
+Environment=OPENID_PROVIDER_URL=https://auth.franksdank.cloud/application/o/open-webui/.well-known/openid-configuration
+Environment=OPENID_REDIRECT_URI=https://ai.franksdank.cloud/oauth/oidc/callback
+Environment=WEBUI_URL=https://ai.franksdank.cloud
+Environment=ENABLE_OAUTH_SIGNUP=true
+Environment=OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
+Environment=OAUTH_SCOPES=openid email profile roles
+Environment=ENABLE_OAUTH_ROLE_MANAGEMENT=true
+
 # Web search -> SearXNG, reached over the host-published port (NOT the
 # search.franksdank.cloud vhost): the Anubis->Authentik guard chain is a
 # browser mechanism and a plain HTTP client cannot solve it. The internal