Add Authelia as centralized authentication and OIDC provider

Authelia runs as a managed native service on Wild Central, providing
two integration patterns for network services:

- Forward-auth via HAProxy for apps without native SSO (Lua auth-request
  script intercepts requests, redirects unauthenticated users to login portal)
- OIDC provider for apps with native support (Gitea, Grafana, etc.)

Backend: new internal/authelia/ package with service manager, config
generation, file-based user management (argon2id), and OIDC client
management. API endpoints for status, config, users CRUD, and OIDC
clients CRUD.

HAProxy: config generator extended with lua-load, auth-request
directives, and Authelia backend. Auth directives scoped to session
cookie domain — only subdomains of the auth portal's parent are
eligible for forward-auth.

Frontend: Authentication page with enable/disable, user management,
OIDC client management (add/edit/delete), and protected domains
toggles. Advanced subsystem page for raw config view. Dashboard
service card and sidebar entries.

internal/config/config.go

@@ -114,6 +114,15 @@ type State struct {
 			Provider        string `yaml:"provider,omitempty" json:"provider,omitempty"`
 			IntervalMinutes int    `yaml:"intervalMinutes,omitempty" json:"intervalMinutes,omitempty"`
 		} `yaml:"ddns,omitempty" json:"ddns,omitempty"`
+		Authelia struct {
+			Enabled       bool   `yaml:"enabled,omitempty" json:"enabled,omitempty"`
+			Domain        string `yaml:"domain,omitempty" json:"domain,omitempty"`                 // login portal domain (e.g. auth.payne.io)
+			DefaultPolicy string `yaml:"defaultPolicy,omitempty" json:"defaultPolicy,omitempty"`   // one_factor or two_factor
+		} `yaml:"authelia,omitempty" json:"authelia,omitempty"`
+		DNSFilter struct {
+			Enabled       bool `yaml:"enabled,omitempty" json:"enabled,omitempty"`
+			IntervalHours int  `yaml:"intervalHours,omitempty" json:"intervalHours,omitempty"` // update interval, default 24
+		} `yaml:"dnsFilter,omitempty" json:"dnsFilter,omitempty"`
 	} `yaml:"cloud,omitempty" json:"cloud,omitempty"`
 }