Move GoToSocial login from Authentik to Pocket ID

The first Pocket ID login linked to the existing account by email, then
GTS_OIDC_LINK_EXISTING was switched off so only that Pocket ID identity
can sign in. The Authentik credentials stay in the vault for rollback.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/gotosocial-compose.yml.j2

@@ -4,7 +4,7 @@ services:
     container_name: gotosocial
     user: 1000:1000
     extra_hosts:
-      - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
+      - '{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}'
     environment:
       GTS_HOST: {{ subdomains.social }}
       GTS_DB_TYPE: sqlite
@@ -15,11 +15,11 @@ services:
       GTS_TRUSTED_PROXIES: "{{ docker.hairpin_ip }}"
       GTS_ACCOUNT_DOMAIN: {{ primary_domain }}
       GTS_OIDC_ENABLED: "true"
-      GTS_OIDC_IDP_NAME: "Authentik"
-      GTS_OIDC_ISSUER: https://{{ subdomains.auth }}/application/o/gotosocial/
-      GTS_OIDC_CLIENT_ID: {{ vault_gotosocial.oidc.client_id }}
-      GTS_OIDC_CLIENT_SECRET: {{ vault_gotosocial.oidc.client_secret }}
-      GTS_OIDC_LINK_EXISTING: "true"
+      GTS_OIDC_IDP_NAME: "Pocket ID"
+      GTS_OIDC_ISSUER: https://{{ subdomains.pocketid }}
+      GTS_OIDC_CLIENT_ID: {{ vault_gotosocial.pocketid.client_id }}
+      GTS_OIDC_CLIENT_SECRET: {{ vault_gotosocial.pocketid.client_secret }}
+      GTS_OIDC_LINK_EXISTING: "false"
       GTS_HTTP_CLIENT: "20s"
       GTS_SMTP_HOST: "{{ smtp.host }}"
       GTS_SMTP_PORT: "587"