multistreaming: scenes/composition, installer build support, service updates

- multistreaming (new): RTMP ingest + multi-platform fan-out with pluggable providers (Twitch/YouTube/Kick/custom), zero-knowledge key vaults, Authelia OIDC auth, shared rooms with editor/streamer roles, single-use invites, per-account streaming grants, and scenes & composition (grid/PiP layouts, text/image overlays, per-output audio routing).
- installer: support Dockerfile build in metadata (not just image) and RSA key generation for the Authelia OIDC JWKS.
- authelia: add OIDC provider with portainer + multistreaming clients (public + PKCE).
- services: remove allprox; add nginx-proxy-manager and portainer; update lldap; regenerate catalog.

services/nginx-proxy-manager/metadata.json

@@ -0,0 +1,35 @@
+{
+  "id": "nginx-proxy-manager",
+  "name": "Nginx Proxy Manager",
+  "description": "Web dashboard for Nginx reverse proxying: add/edit proxy hosts (domain -> service) at runtime, automatic Let's Encrypt SSL, access lists, and persistent configuration.",
+  "version": "1.0.0",
+  "category": "network",
+  "tags": ["reverse-proxy", "nginx", "dashboard", "lets-encrypt", "https", "proxy-manager"],
+  "author": "jc21 / Nginx Proxy Manager",
+  "license": "MIT",
+  "homepage": "https://nginxproxymanager.com",
+  "documentation": "https://nginxproxymanager.com/guide/",
+  "compose": {
+    "image": "jc21/nginx-proxy-manager:2.14.0",
+    "container_name": "nginx-proxy-manager",
+    "restart": "unless-stopped",
+    "ports": [
+      "80:80",
+      "443:443",
+      "81:81"
+    ],
+    "volumes": [
+      "npm_data:/data",
+      "npm_letsencrypt:/etc/letsencrypt"
+    ],
+    "networks": ["homelab"]
+  },
+  "volumes": {
+    "npm_data": {},
+    "npm_letsencrypt": {}
+  },
+  "networks": {
+    "homelab": { "external": true }
+  },
+  "notes": "Dashboard at http://<host>:81 — first login admin@example.com / changeme (change it immediately, and restrict port 81 or apply an access list). Add Proxy Hosts like streaming.example.com -> multistreaming:8080 (enable Websockets) or auth.example.com -> authelia:9091; use the container/service name as the forward hostname since everything shares the homelab network. All proxy hosts, users, and certs persist in the npm_data and npm_letsencrypt volumes, so they survive restarts and updates. RTMP ingest is not HTTP, so it does NOT go through NPM: OBS connects directly to the multistreaming container's published port 1935 (rtmp://feed.streaming.example.com:1935/live/<stream-key>). SSO forward-auth for apps without OIDC: on the proxy host, add a custom location /authelia pointing to http://authelia:9091/api/authz/forward-auth with headers X-Original-URL $scheme://$http_host$request_uri, X-Forwarded-Proto $scheme, X-Forwarded-Host $http_host, X-Forwarded-Uri $request_uri, and then add `auth_request /authelia;` plus `auth_request_set $user $upstream_http_remote_user;` and `proxy_set_header Remote-User $user;` in the Advanced tab."
+}