Retire Authentik now that every app logs in with Pocket ID

All of Authentik's applications (including Tailscale's tailnet login)
have moved to Pocket ID, and its only recent sign-ins were those
handovers. Drops its stack, the auth. route and DNS record, the auth
subdomain variables, Gotify's leftover hairpin entries, and the dockcheck
exclude; the docs now name Pocket ID as the SSO provider.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

group_vars/all/domains.yml

@@ -4,7 +4,6 @@ secondary_domain: "nerder.land"
 
 # Subdomain mappings
 subdomains:
-  auth: "auth.{{ primary_domain }}"
   git: "git.{{ primary_domain }}"
   cal: "cal.{{ primary_domain }}"
   docs: "docs.{{ primary_domain }}"
@@ -33,6 +32,5 @@ subdomains:
 # Email domains for notifications
 email_domains:
   updates: "updates.{{ primary_domain }}"
-  auth_email: "auth@updates.{{ primary_domain }}"
   git_email: "git@updates.{{ primary_domain }}"
   cal_email: "cal@updates.{{ primary_domain }}"

group_vars/docker/services.yml

@@ -2,7 +2,7 @@
 
 # Service categories for organization
 service_categories:
-  infrastructure: ["caddy", "authentik", "dockge", "gondulf"]
+  infrastructure: ["caddy", "dockge", "gondulf"]
   development: ["gitea", "bytestash"]
   media: ["audiobookshelf", "kavita", "hoarder", "manyfold"]
   productivity: ["paperlessngx", "baikal", "syncthing", "heyform", "dawarich", "obsidian-livesync", "gokapi"]