Add Pocket ID as a passkey login provider at id.thesatelliteoflove.com

Runs next to Authentik. The encryption key lives in vault_pocketid, and
the .env task hides its diff so the key doesn't show up in output.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/pocketid-compose.yml.j2

@@ -0,0 +1,26 @@
+services:
+  pocket-id:
+    image: ghcr.io/pocket-id/pocket-id:v2
+    container_name: pocket-id
+    restart: unless-stopped
+    env_file: .env
+    volumes:
+      - ./data:/app/data
+    healthcheck:
+      test: ["CMD", "/app/pocket-id", "healthcheck"]
+      interval: 1m30s
+      timeout: 5s
+      retries: 2
+      start_period: 10s
+    labels:
+      glance.name: Pocket ID
+      glance.icon: si:passkey
+      glance.url: https://{{ subdomains.pocketid }}/
+      glance.description: Passkey OIDC provider
+      glance.id: pocketid
+      mag37.dockcheck.update: true
+
+networks:
+  default:
+    external: true
+    name: {{ docker.network_name }}