multistreaming: scenes/composition, installer build support, service updates

- multistreaming (new): RTMP ingest + multi-platform fan-out with pluggable providers (Twitch/YouTube/Kick/custom), zero-knowledge key vaults, Authelia OIDC auth, shared rooms with editor/streamer roles, single-use invites, per-account streaming grants, and scenes & composition (grid/PiP layouts, text/image overlays, per-output audio routing).
- installer: support Dockerfile build in metadata (not just image) and RSA key generation for the Authelia OIDC JWKS.
- authelia: add OIDC provider with portainer + multistreaming clients (public + PKCE).
- services: remove allprox; add nginx-proxy-manager and portainer; update lldap; regenerate catalog.

docs/metadata-schema.json

@@ -26,7 +26,7 @@
     },
     "compose": {
       "type": "object",
-      "description": "A Docker Compose service definition (image, ports, volumes, environment, ...)."
+      "description": "A Docker Compose service definition. Must set either `image` (pull a prebuilt image) or `build` (build from a Dockerfile, e.g. { \"context\": \".\", \"dockerfile\": \"Dockerfile\" }), plus ports, volumes, environment, etc."
     },
     "volumes": {
       "type": "object",
@@ -55,6 +55,20 @@
         }
       }
     },
+    "rsaKeys": {
+      "type": "array",
+      "description": "RSA private keys the installer generates into files on first install (used for OIDC signing keys that cannot be injected via env).",
+      "items": {
+        "type": "object",
+        "required": ["name", "path"],
+        "additionalProperties": false,
+        "properties": {
+          "name": { "type": "string" },
+          "path": { "type": "string" },
+          "bits": { "type": "number" }
+        }
+      }
+    },
     "category": { "type": "string" },
     "tags": { "type": "array", "items": { "type": "string" } },
     "icon": { "type": "string", "format": "uri" },