open-webui: SSO via authentik (OIDC authorization-code flow)

- quadlet: OAUTH_*/OPENID_* env + EnvironmentFile for the client secret
  (secret stays off-repo in /home/dank/Containers/open-webui/env, mode 600)
- authentik objects created live: application 'open-webui', OAuth2 provider
  'Open WebUI' (Strict redirect URI), 'Open WebUI roles' scope mapping,
  entitlements Open WebUI Users/Admins bound to openwebui_users/admins
- e2e: 18-openwebui-sso.spec.ts (silent SSO round-trip) + prefix in config
- unit tests: OIDC wiring + secret-hygiene assertions
- docs: SSO section + history entry

tests/open_webui_quadlet.bats

@@ -89,3 +89,36 @@ QDIR="$REPO_ROOT/dankclaw/open-webui/quadlet"
     fi
     has_no_leaked_secret "$QDIR/open-webui.container"
 }
+
+@test "open-webui OIDC: provider URL points at the open-webui application on auth.franksdank.cloud" {
+    # The OAuth client lives in authentik (application slug "open-webui");
+    # the container reaches the IdP over the public URL (Caddy publishes
+    # 0.0.0.0:443, Pi-hole resolves the name to the host LAN IP).
+    grep -qE '^Environment=OPENID_PROVIDER_URL=https://auth\.franksdank\.cloud/application/o/open-webui/\.well-known/openid-configuration$' \
+        "$QDIR/open-webui.container" \
+        || { echo "open-webui.container: OPENID_PROVIDER_URL must point at the open-webui application on auth.franksdank.cloud"; return 1; }
+}
+
+@test "open-webui OIDC: redirect URI matches the ai.franksdank.cloud vhost" {
+    # The browser-side callback must land on the published vhost; the
+    # authentik provider allows exactly this URI (Strict).
+    grep -qE '^Environment=OPENID_REDIRECT_URI=https://ai\.franksdank\.cloud/oauth/oidc/callback$' \
+        "$QDIR/open-webui.container" \
+        || { echo "open-webui.container: OPENID_REDIRECT_URI must be the ai.franksdank.cloud callback"; return 1; }
+}
+
+@test "open-webui OIDC: WEBUI_URL, signup, email merge, and role management" {
+    grep -qE '^Environment=WEBUI_URL=https://ai\.franksdank\.cloud$' "$QDIR/open-webui.container"
+    grep -qE '^Environment=ENABLE_OAUTH_SIGNUP=true' "$QDIR/open-webui.container"
+    grep -qE '^Environment=OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true' "$QDIR/open-webui.container"
+    grep -qE '^Environment=ENABLE_OAUTH_ROLE_MANAGEMENT=true' "$QDIR/open-webui.container"
+    grep -qE '^Environment=OAUTH_SCOPES=openid email profile roles$' "$QDIR/open-webui.container"
+}
+
+@test "open-webui OIDC: client secret lives in the host env file, not the unit" {
+    # The client ID is a public identifier and may be tracked; the secret
+    # must come from the git-ignored host env file (mode 600).
+    grep -qE '^EnvironmentFile=/home/dank/Containers/open-webui/env$' "$QDIR/open-webui.container" \
+        || { echo "open-webui.container: must load the client secret from the host env file"; return 1; }
+    ! grep -q 'OAUTH_CLIENT_SECRET' "$QDIR/open-webui.container"
+}