multistreaming: scenes/composition, installer build support, service updates

- multistreaming (new): RTMP ingest + multi-platform fan-out with pluggable providers (Twitch/YouTube/Kick/custom), zero-knowledge key vaults, Authelia OIDC auth, shared rooms with editor/streamer roles, single-use invites, per-account streaming grants, and scenes & composition (grid/PiP layouts, text/image overlays, per-output audio routing).
- installer: support Dockerfile build in metadata (not just image) and RSA key generation for the Authelia OIDC JWKS.
- authelia: add OIDC provider with portainer + multistreaming clients (public + PKCE).
- services: remove allprox; add nginx-proxy-manager and portainer; update lldap; regenerate catalog.

services/authelia/metadata.json

@@ -1,23 +1,27 @@
 {
   "id": "authelia",
   "name": "Authelia",
-  "description": "Open-source authentication and authorization server providing SSO and 2FA for the homelab.",
-  "version": "1.0.0",
+  "description": "Open-source authentication and authorization server providing SSO, 2FA, forward-auth, and an OIDC provider for the homelab.",
+  "version": "3.0.0",
   "category": "identity",
-  "tags": ["sso", "authentication", "2fa", "oidc", "forward-auth"],
+  "tags": ["sso", "authentication", "2fa", "oidc", "forward-auth", "idp"],
   "author": "Authelia",
   "license": "Apache-2.0",
   "homepage": "https://www.authelia.com",
   "documentation": "https://www.authelia.com/configuration/prologue/introduction/",
   "compose": {
-    "image": "authelia/authelia:latest",
+    "image": "authelia/authelia:4.39.14",
     "container_name": "authelia",
     "restart": "unless-stopped",
     "ports": ["9091:9091"],
     "volumes": [
       "authelia_config:/config",
       "./configuration.yml:/config/configuration.yml:ro",
-      "./users_database.yml:/config/users_database.yml:ro"
+      "./users_database.yml:/config/users_database.yml:ro",
+      "./oidc-jwks.pem:/config/oidc-jwks.pem:ro"
+    ],
+    "environment": [
+      "X_AUTHELIA_CONFIG_FILTERS=template"
     ],
     "networks": ["homelab"]
   },
@@ -50,8 +54,26 @@
       "default": "changeme-admin",
       "required": false,
       "secret": true
+    },
+    {
+      "name": "OIDC_HMAC_SECRET",
+      "label": "OIDC HMAC secret (auto-generated)",
+      "generate": true
+    },
+    {
+      "name": "OIDC_PORTAINER_SECRET",
+      "label": "Portainer OIDC client secret (auto-generated)",
+      "description": "Copy this value into Portainer's OAuth client-secret field",
+      "generate": true
+    }
+  ],
+  "rsaKeys": [
+    {
+      "name": "OIDC_JWKS_KEY",
+      "path": "oidc-jwks.pem",
+      "bits": 2048
     }
   ],
   "dependsOn": ["lldap"],
-  "notes": "Authelia's portal is normally reached through allprox at auth.example.com (see the allprox Caddyfile). The forward-auth endpoint is http://authelia:9091/api/authz/forward-auth. Default access-control rules protect portal.example.com and *.example.com — edit configuration.yml to match your domains."
+  "notes": "SSO / IdP: exposes a login portal (https://auth.example.com via nginx-proxy-manager) and a forward-auth endpoint (http://authelia:9091/api/authz/forward-auth). OIDC issuer: https://auth.example.com — discovery at /.well-known/openid-configuration. Two clients are pre-registered: 'portainer' (confidential, secret in OIDC_PORTAINER_SECRET) and 'multistreaming' (public + PKCE, no secret; redirect_uri https://streaming.example.com/api/auth/oidc/callback). For apps without OIDC (lldap web UI), protect them with a forward-auth auth_request block in nginx-proxy-manager's Advanced tab. The OIDC signing key (oidc-jwks.pem) is generated once by the installer and never rotated. Default access-control protects *.example.com with one factor; edit configuration.yml to change domains or require 2FA."
 }