Retire Authentik now that every app logs in with Pocket ID

All of Authentik's applications (including Tailscale's tailnet login)
have moved to Pocket ID, and its only recent sign-ins were those
handovers. Drops its stack, the auth. route and DNS record, the auth
subdomain variables, Gotify's leftover hairpin entries, and the dockcheck
exclude; the docs now name Pocket ID as the SSO provider.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/README.md

@@ -12,7 +12,7 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 - **Firewall Integration**: UFW-Docker script properly configures firewall rules
 
 ### Security Features
-- **Centralized SSO**: Authentik provides OIDC authentication for most services
+- **Centralized SSO**: Pocket ID provides passkey OIDC authentication for most services
 - **Network Isolation**: Services restricted to appropriate network segments
 - **Container Hardening**: Non-root users, capability dropping, security options
 - **Secret Management**: Ansible vault for sensitive configuration
@@ -22,7 +22,7 @@ Deploys and manages a comprehensive self-hosted infrastructure with 24 container
 
 ### Infrastructure (`infrastructure/`)
 - **Caddy** - Reverse proxy with automatic HTTPS (static IP: 172.20.0.5)
-- **Authentik** - Enterprise authentication server (OIDC/SAML SSO)
+- **Pocket ID** - Passkey OIDC provider
 - **Dockge** - Docker compose stack management UI
 
 ### Development (`development/`)
@@ -89,7 +89,7 @@ roles/docker/
 │   ├── infrastructure/
 │   │   ├── main.yml               # Infrastructure category orchestrator
 │   │   ├── caddy.yml              # Reverse proxy
-│   │   └── authentik.yml          # Authentication
+│   │   └── pocketid.yml           # Authentication
 │   ├── development/
 │   │   ├── main.yml               # Development category orchestrator
 │   │   ├── gitea.yml              # Git hosting
@@ -135,7 +135,7 @@ ansible-playbook site.yml -i hosts.yml --tags infrastructure,monitoring
 ### Deploy Individual Services
 ```bash
 # Deploy specific services
-ansible-playbook site.yml -i hosts.yml --tags authentik
+ansible-playbook site.yml -i hosts.yml --tags pocketid
 ansible-playbook site.yml -i hosts.yml --tags gitea,bytestash
 ansible-playbook site.yml -i hosts.yml --tags paperlessngx
 ```
@@ -145,7 +145,7 @@ ansible-playbook site.yml -i hosts.yml --tags paperlessngx
 ### MMDL (Task Management)
 - **URL**: https://tasks.thesatelliteoflove.com
 - **Initial Setup**: Visit `/install` endpoint first to run database migrations
-- **Authentication**: Integrates with Authentik OIDC provider
+- **Authentication**: Integrates with the Pocket ID OIDC provider
 - **Database**: Uses MySQL 8.0 with automatic schema migration
 - **Features**: CalDAV integration, multiple account support, task management
 
@@ -181,7 +181,7 @@ The role uses a centralized variable hierarchy in `group_vars/all/`:
 
 ### Network Configuration
 Services expect to be accessible via subdomains of configured domains:
-- `auth.thesatelliteoflove.com` - Authentik
+- `id.thesatelliteoflove.com` - Pocket ID
 - `git.thesatelliteoflove.com` - Gitea
 - `books.thesatelliteoflove.com` - Kavita
 - `tasks.thesatelliteoflove.com` - MMDL
@@ -203,7 +203,7 @@ Services expect to be accessible via subdomains of configured domains:
 - Restricted access for sensitive tools (Stirling PDF)
 
 ### Authentication
-- Centralized SSO through Authentik for most services
+- Centralized SSO through Pocket ID for most services
 - OAuth integration where supported
 - Secure secret management through Ansible vault