Add SMTP support for Authelia notifications and fix config persistence

SMTP: Add host, port, username, sender, and password fields to the
Authelia configuration. Uses modern address format (submission:// for
STARTTLS on 587, smtps:// for implicit TLS on 465) with explicit TLS
server name. Falls back to filesystem notifier when SMTP is not
configured.

Fixes: Config changes now persist before attempting service restart,
so a restart failure (e.g. bad SMTP credentials) no longer prevents
saving. The specific Authelia error is extracted from the journal and
shown in the UI.

Frontend: SMTP fields added to the Authentication config card. Form
no longer continuously resets from server state while user is editing.
OIDC client edit UI added (pencil icon).

internal/authelia/config.go

@@ -25,6 +25,11 @@ type ConfigOpts struct {
 	DataDir        string       // authelia data directory path
 	ListenAddr     string       // listen address (default: 127.0.0.1:9091)
 	OIDCClients    []OIDCClient // registered OIDC clients
+	SMTPHost       string       // SMTP server host (empty = use filesystem notifier)
+	SMTPPort       int          // SMTP server port (default: 587)
+	SMTPUsername   string       // SMTP login username (defaults to sender if empty)
+	SMTPSender     string       // From address
+	SMTPPassword   string       // SMTP password (from secrets)
 }
 
 // GenerateConfig builds Authelia's configuration.yml and writes it atomically.
@@ -143,11 +148,7 @@ func (m *Manager) buildConfig(opts ConfigOpts) map[string]any {
 			},
 		},
 
-		"notifier": map[string]any{
-			"filesystem": map[string]any{
-				"filename": m.notificationPath(),
-			},
-		},
+		"notifier": buildNotifier(opts, m.notificationPath()),
 
 		"identity_validation": map[string]any{
 			"reset_password": map[string]any{
@@ -202,6 +203,40 @@ func (m *Manager) buildConfig(opts ConfigOpts) map[string]any {
 	return cfg
 }
 
+// buildNotifier returns the notifier config — SMTP if configured, filesystem otherwise.
+func buildNotifier(opts ConfigOpts, filesystemPath string) map[string]any {
+	if opts.SMTPHost != "" && opts.SMTPSender != "" {
+		username := opts.SMTPUsername
+		if username == "" {
+			username = opts.SMTPSender
+		}
+		port := opts.SMTPPort
+		if port == 0 {
+			port = 587
+		}
+		// Use the modern address format: submission:// for STARTTLS on 587, smtps:// for implicit TLS on 465
+		scheme := "submission"
+		if port == 465 {
+			scheme = "smtps"
+		}
+		smtp := map[string]any{
+			"address":  fmt.Sprintf("%s://%s:%d", scheme, opts.SMTPHost, port),
+			"sender":   opts.SMTPSender,
+			"username": username,
+			"password": opts.SMTPPassword,
+			"tls": map[string]any{
+				"server_name": opts.SMTPHost,
+			},
+		}
+		return map[string]any{"smtp": smtp}
+	}
+	return map[string]any{
+		"filesystem": map[string]any{
+			"filename": filesystemPath,
+		},
+	}
+}
+
 // GenerateSecret creates a cryptographically random hex string of the given byte length.
 func GenerateSecret(byteLen int) (string, error) {
 	b := make([]byte, byteLen)