Add Authelia as centralized authentication and OIDC provider

Authelia runs as a managed native service on Wild Central, providing
two integration patterns for network services:

- Forward-auth via HAProxy for apps without native SSO (Lua auth-request
  script intercepts requests, redirects unauthenticated users to login portal)
- OIDC provider for apps with native support (Gitea, Grafana, etc.)

Backend: new internal/authelia/ package with service manager, config
generation, file-based user management (argon2id), and OIDC client
management. API endpoints for status, config, users CRUD, and OIDC
clients CRUD.

HAProxy: config generator extended with lua-load, auth-request
directives, and Authelia backend. Auth directives scoped to session
cookie domain — only subdomains of the auth portal's parent are
eligible for forward-auth.

Frontend: Authentication page with enable/disable, user management,
OIDC client management (add/edit/delete), and protected domains
toggles. Advanced subsystem page for raw config view. Dashboard
service card and sidebar entries.

web/src/components/advanced/AutheliaSubsystem.tsx

@@ -0,0 +1,41 @@
+import { useState } from 'react';
+import { useQuery, useMutation } from '@tanstack/react-query';
+import { KeyRound } from 'lucide-react';
+import { autheliaApi } from '../../services/api/authelia';
+import { SubsystemPage } from '../SubsystemPage';
+
+export function AutheliaSubsystem() {
+  const [successMsg, setSuccessMsg] = useState<string | null>(null);
+  const [errorMsg, setErrorMsg] = useState<string | null>(null);
+
+  const configQuery = useQuery({
+    queryKey: ['authelia', 'config', 'raw'],
+    queryFn: () => autheliaApi.getConfig(),
+  });
+
+  const restartMutation = useMutation({
+    mutationFn: () => autheliaApi.restart(),
+    onSuccess: () => {
+      setSuccessMsg('Authelia restarted');
+      setErrorMsg(null);
+      setTimeout(() => setSuccessMsg(null), 5000);
+    },
+    onError: (e: Error) => setErrorMsg(e.message),
+  });
+
+  return (
+    <SubsystemPage
+      title="Authelia"
+      description="Authentication and identity provider"
+      icon={KeyRound}
+      daemonKey="authelia"
+      configContent={configQuery.data?.content}
+      isLoadingConfig={configQuery.isLoading}
+      onRestart={() => restartMutation.mutate()}
+      isRestarting={restartMutation.isPending}
+      restartLabel="Restart Authelia"
+      successMessage={successMsg}
+      errorMessage={errorMsg}
+    />
+  );
+}

web/src/components/advanced/index.ts

@@ -3,3 +3,4 @@ export { DnsmasqSubsystem } from './DnsmasqSubsystem';
 export { NftablesSubsystem } from './NftablesSubsystem';
 export { WireguardSubsystem } from './WireguardSubsystem';
 export { CrowdsecSubsystem } from './CrowdsecSubsystem';
+export { AutheliaSubsystem } from './AutheliaSubsystem';