Add Pocket ID as a passkey login provider at id.thesatelliteoflove.com

Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

group_vars/all/domains.yml

@@ -29,6 +29,7 @@ subdomains:
   dir2opds: "opds.{{ primary_domain }}"  # dir2opds OPDS catalog
   kosync: "sync.{{ primary_domain }}"  # KOReader sync server
   gokapi: "gokapi.{{ primary_domain }}"  # Gokapi file sharing
+  pocketid: "id.{{ primary_domain }}"  # Pocket ID passkey OIDC
 
 # Email domains for notifications
 email_domains: