Add Authelia as centralized authentication and OIDC provider

Authelia runs as a managed native service on Wild Central, providing
two integration patterns for network services:

- Forward-auth via HAProxy for apps without native SSO (Lua auth-request
  script intercepts requests, redirects unauthenticated users to login portal)
- OIDC provider for apps with native support (Gitea, Grafana, etc.)

Backend: new internal/authelia/ package with service manager, config
generation, file-based user management (argon2id), and OIDC client
management. API endpoints for status, config, users CRUD, and OIDC
clients CRUD.

HAProxy: config generator extended with lua-load, auth-request
directives, and Authelia backend. Auth directives scoped to session
cookie domain — only subdomains of the auth portal's parent are
eligible for forward-auth.

Frontend: Authentication page with enable/disable, user management,
OIDC client management (add/edit/delete), and protected domains
toggles. Advanced subsystem page for raw config view. Dashboard
service card and sidebar entries.

web/src/router/pages/AutheliaPage.tsx

@@ -0,0 +1,10 @@
+import { ErrorBoundary } from '../../components';
+import { AutheliaComponent } from '../../components/AutheliaComponent';
+
+export function AutheliaPage() {
+  return (
+    <ErrorBoundary>
+      <AutheliaComponent />
+    </ErrorBoundary>
+  );
+}

web/src/router/pages/advanced/AutheliaPage.tsx

@@ -0,0 +1,10 @@
+import { ErrorBoundary } from '../../../components';
+import { AutheliaSubsystem } from '../../../components/advanced';
+
+export function AutheliaAdvancedPage() {
+  return (
+    <ErrorBoundary>
+      <AutheliaSubsystem />
+    </ErrorBoundary>
+  );
+}

web/src/router/pages/advanced/index.ts

@@ -3,3 +3,4 @@ export { DnsmasqPage } from './DnsmasqPage';
 export { NftablesPage } from './NftablesPage';
 export { WireguardPage } from './WireguardPage';
 export { CrowdsecPage } from './CrowdsecPage';
+export { AutheliaAdvancedPage } from './AutheliaPage';

web/src/router/routes.tsx

@@ -7,9 +7,12 @@ import { FirewallPage } from './pages/FirewallPage';
 import { VpnPage } from './pages/VpnPage';
 import { CrowdSecPage } from './pages/CrowdSecPage';
 import { DhcpPage } from './pages/DhcpPage';
+import { DnsFilterPage } from './pages/DnsFilterPage';
+import { AutheliaPage } from './pages/AutheliaPage';
 import {
   HaproxyPage, DnsmasqPage, NftablesPage, WireguardPage,
   CrowdsecPage as CrowdsecAdvancedPage,
+  AutheliaAdvancedPage,
 } from './pages/advanced';
 
 export const routes: RouteObject[] = [
@@ -22,12 +25,15 @@ export const routes: RouteObject[] = [
       { path: 'firewall', element: <FirewallPage /> },
       { path: 'vpn', element: <VpnPage /> },
       { path: 'crowdsec', element: <CrowdSecPage /> },
+      { path: 'auth', element: <AutheliaPage /> },
       { path: 'dhcp', element: <DhcpPage /> },
+      { path: 'dns-filter', element: <DnsFilterPage /> },
       { path: 'advanced/haproxy', element: <HaproxyPage /> },
       { path: 'advanced/dnsmasq', element: <DnsmasqPage /> },
       { path: 'advanced/nftables', element: <NftablesPage /> },
       { path: 'advanced/wireguard', element: <WireguardPage /> },
       { path: 'advanced/crowdsec', element: <CrowdsecAdvancedPage /> },
+      { path: 'advanced/authelia', element: <AutheliaAdvancedPage /> },
     ],
   },
   {