Add SMTP support for Authelia notifications and fix config persistence

SMTP: Add host, port, username, sender, and password fields to the
Authelia configuration. Uses modern address format (submission:// for
STARTTLS on 587, smtps:// for implicit TLS on 465) with explicit TLS
server name. Falls back to filesystem notifier when SMTP is not
configured.

Fixes: Config changes now persist before attempting service restart,
so a restart failure (e.g. bad SMTP credentials) no longer prevents
saving. The specific Authelia error is extracted from the journal and
shown in the UI.

Frontend: SMTP fields added to the Authentication config card. Form
no longer continuously resets from server state while user is editing.
OIDC client edit UI added (pencil icon).

internal/authelia/manager.go

@@ -95,17 +95,66 @@ func (m *Manager) GetStatus() (*Status, error) {
 	return status, nil
 }
 
-// RestartService restarts the Authelia systemd service
+// RestartService restarts the Authelia systemd service and verifies it stays running.
 func (m *Manager) RestartService() error {
 	cmd := exec.Command("systemctl", "restart", "authelia.service")
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		return fmt.Errorf("failed to restart authelia: %w (output: %s)", err, string(output))
 	}
+
+	// Give it a moment to start (or crash)
+	time.Sleep(2 * time.Second)
+
+	// Check if it's actually running
+	if exec.Command("systemctl", "is-active", "--quiet", "authelia.service").Run() != nil {
+		// It crashed — grab the error from the journal
+		reason := m.lastError()
+		if reason != "" {
+			return fmt.Errorf("authelia started but crashed: %s", reason)
+		}
+		return fmt.Errorf("authelia started but crashed (check journalctl -u authelia.service)")
+	}
+
 	slog.Info("authelia service restarted", "component", "authelia")
 	return nil
 }
 
+// lastError extracts the most recent error-level message from the Authelia journal.
+// Authelia logs look like: time="..." level=error msg="..." error="..." provider=...
+func (m *Manager) lastError() string {
+	cmd := exec.Command("journalctl", "-u", "authelia.service", "-n", "20", "--no-pager", "-o", "cat")
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return ""
+	}
+	// Find the last line containing level=error
+	var lastErr string
+	for _, line := range strings.Split(string(output), "\n") {
+		if strings.Contains(line, "level=error") {
+			lastErr = line
+		}
+	}
+	if lastErr == "" {
+		return ""
+	}
+	// Extract error="..." field (has the actual detail)
+	if i := strings.Index(lastErr, "error=\""); i >= 0 {
+		detail := lastErr[i+7:]
+		if j := strings.Index(detail, "\""); j >= 0 {
+			return detail[:j]
+		}
+	}
+	// Fall back to msg="..." field
+	if i := strings.Index(lastErr, "msg=\""); i >= 0 {
+		detail := lastErr[i+5:]
+		if j := strings.Index(detail, "\""); j >= 0 {
+			return detail[:j]
+		}
+	}
+	return lastErr
+}
+
 // StopService stops the Authelia systemd service
 func (m *Manager) StopService() error {
 	cmd := exec.Command("systemctl", "stop", "authelia.service")