Add Authelia as centralized authentication and OIDC provider

Authelia runs as a managed native service on Wild Central, providing
two integration patterns for network services:

- Forward-auth via HAProxy for apps without native SSO (Lua auth-request
  script intercepts requests, redirects unauthenticated users to login portal)
- OIDC provider for apps with native support (Gitea, Grafana, etc.)

Backend: new internal/authelia/ package with service manager, config
generation, file-based user management (argon2id), and OIDC client
management. API endpoints for status, config, users CRUD, and OIDC
clients CRUD.

HAProxy: config generator extended with lua-load, auth-request
directives, and Authelia backend. Auth directives scoped to session
cookie domain — only subdomains of the auth portal's parent are
eligible for forward-auth.

Frontend: Authentication page with enable/disable, user management,
OIDC client management (add/edit/delete), and protected domains
toggles. Advanced subsystem page for raw config view. Dashboard
service card and sidebar entries.

internal/domains/manager.go

@@ -58,6 +58,13 @@ type Route struct {
 	IPAllow []string      `yaml:"ipAllow,omitempty" json:"ipAllow,omitempty"` // per-route CIDR whitelist
 }
 
+// AuthConfig describes forward-auth protection for an L7 HTTP domain.
+// Only applicable to domains with backend type "http" (L7 TLS termination).
+type AuthConfig struct {
+	Enabled bool   `yaml:"enabled,omitempty" json:"enabled,omitempty"`
+	Policy  string `yaml:"policy,omitempty" json:"policy,omitempty"` // one_factor, two_factor, bypass
+}
+
 // Domain represents a registered domain. The Domain field is the unique key.
 //
 // Simple domains use Backend directly. Multi-backend domains use Routes
@@ -69,6 +76,7 @@ type Domain struct {
 	Subdomains bool    `yaml:"subdomains,omitempty" json:"subdomains,omitempty"` // also match *.domain
 	Public     bool    `yaml:"public,omitempty" json:"public,omitempty"`         // true = internet-visible (DDNS + external), false = LAN only
 	TLS        TLSMode `yaml:"tls,omitempty" json:"tls,omitempty"`              // passthrough or terminate
+	Auth       *AuthConfig `yaml:"auth,omitempty" json:"auth,omitempty"`        // forward-auth protection (L7 HTTP only)
 
 	// Multi-backend path routing. When present, Backend is ignored.
 	// Each route maps path prefixes to a specific backend with its own L7 options.
@@ -354,6 +362,21 @@ func (m *Manager) Update(domain string, updates map[string]any) error {
 	if tls, ok := updates["tls"].(string); ok {
 		dom.TLS = TLSMode(tls)
 	}
+	if auth, ok := updates["auth"].(map[string]any); ok {
+		if dom.Auth == nil {
+			dom.Auth = &AuthConfig{}
+		}
+		if enabled, ok := auth["enabled"].(bool); ok {
+			dom.Auth.Enabled = enabled
+		}
+		if policy, ok := auth["policy"].(string); ok {
+			dom.Auth.Policy = policy
+		}
+		// Clear auth if disabled and no policy
+		if !dom.Auth.Enabled && dom.Auth.Policy == "" {
+			dom.Auth = nil
+		}
+	}
 
 	return m.Register(*dom)
 }