Add Authelia as centralized authentication and OIDC provider

Authelia runs as a managed native service on Wild Central, providing
two integration patterns for network services:

- Forward-auth via HAProxy for apps without native SSO (Lua auth-request
  script intercepts requests, redirects unauthenticated users to login portal)
- OIDC provider for apps with native support (Gitea, Grafana, etc.)

Backend: new internal/authelia/ package with service manager, config
generation, file-based user management (argon2id), and OIDC client
management. API endpoints for status, config, users CRUD, and OIDC
clients CRUD.

HAProxy: config generator extended with lua-load, auth-request
directives, and Authelia backend. Auth directives scoped to session
cookie domain — only subdomains of the auth portal's parent are
eligible for forward-auth.

Frontend: Authentication page with enable/disable, user management,
OIDC client management (add/edit/delete), and protected domains
toggles. Advanced subsystem page for raw config view. Dashboard
service card and sidebar entries.

web/src/components/DashboardComponent.tsx

@@ -7,7 +7,7 @@ import { Alert, AlertDescription } from './ui/alert';
 import { Badge } from './ui/badge';
 import {
   LayoutDashboard, Cloud, CheckCircle, XCircle, AlertCircle, Loader2,
-  BookOpen, Globe, Router, RotateCw, Key,
+  BookOpen, Globe, Router, RotateCw, Key, KeyRound,
   Shield, Eye, ArrowLeftRight, Lock,
 } from 'lucide-react';
 import { useCloudflare } from '../hooks/useCloudflare';
@@ -22,6 +22,7 @@ const SERVICES = [
   { key: 'nftables', label: 'Firewall', icon: Shield },
   { key: 'wireguard', label: 'VPN', icon: Lock },
   { key: 'crowdsec', label: 'CrowdSec', icon: Eye },
+  { key: 'authelia', label: 'Auth', icon: KeyRound },
 ];
 
 function formatUptime(totalSeconds: number): string {