Retire Authentik now that every app logs in with Pocket ID

All of Authentik's applications (including Tailscale's tailnet login)
have moved to Pocket ID, and its only recent sign-ins were those
handovers. Drops its stack, the auth. route and DNS record, the auth
subdomain variables, Gotify's leftover hairpin entries, and the dockcheck
exclude; the docs now name Pocket ID as the SSO provider.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -14,7 +14,7 @@ The Docker role deploys and manages 21 self-hosted services organized into logic
 
 ### Infrastructure
 - **Caddy** (Reverse proxy with automatic HTTPS)
-- **Authentik** (SSO/Identity Provider)
+- **Pocket ID** (passkey SSO/Identity Provider)
 - **Dockge** (Container management)
 
 ### Development
@@ -84,7 +84,7 @@ Manages scheduled tasks and automation:
 
 ### [Docker Role](roles/docker/README.md)
 The most comprehensive role, deploying 21 containerized services organized into logical categories:
-- **Infrastructure**: Caddy reverse proxy, Authentik SSO, Dockge management
+- **Infrastructure**: Caddy reverse proxy, Pocket ID SSO, Dockge management
 - **Development**: Gitea, ByteStash
 - **Media**: Audiobookshelf, Kavita, Karakeep, Manyfold
 - **Productivity**: Paperless-NGX, Baikal, Syncthing, HeyForm, Dawarich, Obsidian LiveSync
@@ -132,7 +132,7 @@ ansible-playbook site.yml -i hosts.yml --tags services
 
 # Deploy individual services
 ansible-playbook site.yml -i hosts.yml --tags caddy
-ansible-playbook site.yml -i hosts.yml --tags authentik
+ansible-playbook site.yml -i hosts.yml --tags pocketid
 ```
 
 ### Manage DNS Records