multistreaming: scenes/composition, installer build support, service updates

- multistreaming (new): RTMP ingest + multi-platform fan-out with pluggable providers (Twitch/YouTube/Kick/custom), zero-knowledge key vaults, Authelia OIDC auth, shared rooms with editor/streamer roles, single-use invites, per-account streaming grants, and scenes & composition (grid/PiP layouts, text/image overlays, per-output audio routing).
- installer: support Dockerfile build in metadata (not just image) and RSA key generation for the Authelia OIDC JWKS.
- authelia: add OIDC provider with portainer + multistreaming clients (public + PKCE).
- services: remove allprox; add nginx-proxy-manager and portainer; update lldap; regenerate catalog.

services/portainer/metadata.json

@@ -0,0 +1,34 @@
+{
+  "id": "portainer",
+  "name": "Portainer",
+  "description": "Web dashboard to manage Docker: create bridge/macvlan/ipvlan networks (VLANs), assign static IPs to containers, and manage every container/volume/network/image from the browser — all persisted.",
+  "version": "1.0.0",
+  "category": "management",
+  "tags": ["docker", "network", "vlan", "macvlan", "ipvlan", "dashboard", "management"],
+  "author": "Portainer",
+  "license": "Zlib",
+  "homepage": "https://www.portainer.io",
+  "documentation": "https://docs.portainer.io/",
+  "compose": {
+    "image": "portainer/portainer-ce:2.39.1",
+    "container_name": "portainer",
+    "restart": "unless-stopped",
+    "ports": [
+      "9443:9443",
+      "9000:9000",
+      "8000:8000"
+    ],
+    "volumes": [
+      "/var/run/docker.sock:/var/run/docker.sock",
+      "portainer_data:/data"
+    ],
+    "networks": ["homelab"]
+  },
+  "volumes": {
+    "portainer_data": {}
+  },
+  "networks": {
+    "homelab": { "external": true }
+  },
+  "notes": "HTTPS dashboard at https://<host>:9443 (accept the self-signed cert on first visit), or behind nginx-proxy-manager as a Proxy Host portainer.example.com -> portainer:9000. Create the local admin account immediately — Portainer locks itself if you wait more than a few minutes; restart the container to reset. SSO: Portainer supports OIDC natively, so set Settings > Authentication > OAuth with Provider=custom, Client ID=portainer, Client secret=<OIDC_PORTAINER_SECRET from authelia's .env>, Authorization URL=https://auth.example.com/api/oidc/authorization, Token URL=https://auth.example.com/api/oidc/token, Resource URL=https://auth.example.com/api/oidc/userinfo, Redirect URL=https://portainer.example.com, Scopes=openid profile groups email, User identifier=preferred_username. Manage networks under Networks (create macvlan/ipvlan for VLANs — the parent interface, e.g. eth0.10, must already exist on the host), and set per-container static IPs from each container's Network settings. Mounting /var/run/docker.sock gives Portainer root-equivalent Docker access, so keep it behind SSO and off the public internet. All state persists in the portainer_data volume. Port 8000 is only for remote Edge Agents; remove the mapping if you don't use them."
+}