Add SMTP support for Authelia notifications and fix config persistence

SMTP: Add host, port, username, sender, and password fields to the
Authelia configuration. Uses modern address format (submission:// for
STARTTLS on 587, smtps:// for implicit TLS on 465) with explicit TLS
server name. Falls back to filesystem notifier when SMTP is not
configured.

Fixes: Config changes now persist before attempting service restart,
so a restart failure (e.g. bad SMTP credentials) no longer prevents
saving. The specific Authelia error is extracted from the journal and
shown in the UI.

Frontend: SMTP fields added to the Authentication config card. Form
no longer continuously resets from server state while user is editing.
OIDC client edit UI added (pencil icon).

internal/authelia/config.go

@@ -25,6 +25,11 @@ type ConfigOpts struct {
 	DataDir        string       // authelia data directory path
 	ListenAddr     string       // listen address (default: 127.0.0.1:9091)
 	OIDCClients    []OIDCClient // registered OIDC clients
+	SMTPHost       string       // SMTP server host (empty = use filesystem notifier)
+	SMTPPort       int          // SMTP server port (default: 587)
+	SMTPUsername   string       // SMTP login username (defaults to sender if empty)
+	SMTPSender     string       // From address
+	SMTPPassword   string       // SMTP password (from secrets)
 }
 
 // GenerateConfig builds Authelia's configuration.yml and writes it atomically.
@@ -143,11 +148,7 @@ func (m *Manager) buildConfig(opts ConfigOpts) map[string]any {
 			},
 		},
 
-		"notifier": map[string]any{
-			"filesystem": map[string]any{
-				"filename": m.notificationPath(),
-			},
-		},
+		"notifier": buildNotifier(opts, m.notificationPath()),
 
 		"identity_validation": map[string]any{
 			"reset_password": map[string]any{
@@ -202,6 +203,40 @@ func (m *Manager) buildConfig(opts ConfigOpts) map[string]any {
 	return cfg
 }
 
+// buildNotifier returns the notifier config — SMTP if configured, filesystem otherwise.
+func buildNotifier(opts ConfigOpts, filesystemPath string) map[string]any {
+	if opts.SMTPHost != "" && opts.SMTPSender != "" {
+		username := opts.SMTPUsername
+		if username == "" {
+			username = opts.SMTPSender
+		}
+		port := opts.SMTPPort
+		if port == 0 {
+			port = 587
+		}
+		// Use the modern address format: submission:// for STARTTLS on 587, smtps:// for implicit TLS on 465
+		scheme := "submission"
+		if port == 465 {
+			scheme = "smtps"
+		}
+		smtp := map[string]any{
+			"address":  fmt.Sprintf("%s://%s:%d", scheme, opts.SMTPHost, port),
+			"sender":   opts.SMTPSender,
+			"username": username,
+			"password": opts.SMTPPassword,
+			"tls": map[string]any{
+				"server_name": opts.SMTPHost,
+			},
+		}
+		return map[string]any{"smtp": smtp}
+	}
+	return map[string]any{
+		"filesystem": map[string]any{
+			"filename": filesystemPath,
+		},
+	}
+}
+
 // GenerateSecret creates a cryptographically random hex string of the given byte length.
 func GenerateSecret(byteLen int) (string, error) {
 	b := make([]byte, byteLen)

internal/authelia/manager.go

@@ -95,17 +95,66 @@ func (m *Manager) GetStatus() (*Status, error) {
 	return status, nil
 }
 
-// RestartService restarts the Authelia systemd service
+// RestartService restarts the Authelia systemd service and verifies it stays running.
 func (m *Manager) RestartService() error {
 	cmd := exec.Command("systemctl", "restart", "authelia.service")
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		return fmt.Errorf("failed to restart authelia: %w (output: %s)", err, string(output))
 	}
+
+	// Give it a moment to start (or crash)
+	time.Sleep(2 * time.Second)
+
+	// Check if it's actually running
+	if exec.Command("systemctl", "is-active", "--quiet", "authelia.service").Run() != nil {
+		// It crashed — grab the error from the journal
+		reason := m.lastError()
+		if reason != "" {
+			return fmt.Errorf("authelia started but crashed: %s", reason)
+		}
+		return fmt.Errorf("authelia started but crashed (check journalctl -u authelia.service)")
+	}
+
 	slog.Info("authelia service restarted", "component", "authelia")
 	return nil
 }
 
+// lastError extracts the most recent error-level message from the Authelia journal.
+// Authelia logs look like: time="..." level=error msg="..." error="..." provider=...
+func (m *Manager) lastError() string {
+	cmd := exec.Command("journalctl", "-u", "authelia.service", "-n", "20", "--no-pager", "-o", "cat")
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return ""
+	}
+	// Find the last line containing level=error
+	var lastErr string
+	for _, line := range strings.Split(string(output), "\n") {
+		if strings.Contains(line, "level=error") {
+			lastErr = line
+		}
+	}
+	if lastErr == "" {
+		return ""
+	}
+	// Extract error="..." field (has the actual detail)
+	if i := strings.Index(lastErr, "error=\""); i >= 0 {
+		detail := lastErr[i+7:]
+		if j := strings.Index(detail, "\""); j >= 0 {
+			return detail[:j]
+		}
+	}
+	// Fall back to msg="..." field
+	if i := strings.Index(lastErr, "msg=\""); i >= 0 {
+		detail := lastErr[i+5:]
+		if j := strings.Index(detail, "\""); j >= 0 {
+			return detail[:j]
+		}
+	}
+	return lastErr
+}
+
 // StopService stops the Authelia systemd service
 func (m *Manager) StopService() error {
 	cmd := exec.Command("systemctl", "stop", "authelia.service")