Retire Authentik now that every app logs in with Pocket ID

All of Authentik's applications (including Tailscale's tailnet login)
have moved to Pocket ID, and its only recent sign-ins were those
handovers. Drops its stack, the auth. route and DNS record, the auth
subdomain variables, Gotify's leftover hairpin entries, and the dockcheck
exclude; the docs now name Pocket ID as the SSO provider.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/Caddyfile.j2

@@ -1,7 +1,3 @@
-auth.thesatelliteoflove.com {
-    reverse_proxy authentik-server-1:9000
-}
-
 {{ subdomains.pocketid }} {
     reverse_proxy pocket-id:1411
 }

roles/docker/templates/authentik-compose.yml.j2

@@ -1,88 +0,0 @@
----
-
-services:
-  postgresql:
-    image: docker.io/library/postgres:16-alpine
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 5s
-    volumes:
-      - database:/var/lib/postgresql/data
-    environment:
-      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
-      POSTGRES_USER: ${PG_USER:-authentik}
-      POSTGRES_DB: ${PG_DB:-authentik}
-    env_file:
-      - .env
-  trout:
-    image: docker.io/library/redis:alpine
-    command: --save 60 1 --loglevel warning
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 3s
-    volumes:
-      - trout:/data
-  server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.2}
-    restart: unless-stopped
-    command: server
-    environment:
-      AUTHENTIK_REDIS__HOST: trout
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-    volumes:
-      - ./media:/media
-      - ./custom-templates:/templates
-    env_file:
-      - .env
-    depends_on:
-      - postgresql
-      - trout
-  worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.2}
-    restart: unless-stopped
-    command: worker
-    environment:
-      AUTHENTIK_REDIS__HOST: trout
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-    # `user: root` and the docker socket volume are optional.
-    # See more for the docker socket integration here:
-    # https://goauthentik.io/docs/outposts/integrations/docker
-    # Removing `user: root` also prevents the worker from fixing the permissions
-    # on the mounted folders, so when removing this make sure the folders have the correct UID/GID
-    # (1000:1000 by default)
-    user: root
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./media:/media
-      - ./certs:/certs
-      - ./custom-templates:/templates
-    env_file:
-      - .env
-    depends_on:
-      - postgresql
-      - trout
-
-volumes:
-  database:
-    driver: local
-  trout:
-    driver: local
-
-networks:
-  default:
-    external: true
-    name: {{ docker.network_name }}

roles/docker/templates/authentik-env.j2

@@ -1,15 +0,0 @@
-PG_PASS={{ vault_authentik.postgres_password }}
-AUTHENTIK_SECRET_KEY={{ vault_authentik.secret_key }}
-# SMTP Host Emails are sent to
-AUTHENTIK_EMAIL__HOST={{ smtp.host }}
-AUTHENTIK_EMAIL__PORT=25
-# Optionally authenticate (don't add quotation marks to your password)
-AUTHENTIK_EMAIL__USERNAME={{ smtp.username }}
-AUTHENTIK_EMAIL__PASSWORD={{ vault_smtp.password }}
-# Use StartTLS
-AUTHENTIK_EMAIL__USE_TLS=true
-# Use SSL
-AUTHENTIK_EMAIL__USE_SSL=false
-AUTHENTIK_EMAIL__TIMEOUT=10
-# Email address authentik will send from, should have a correct @domain
-AUTHENTIK_EMAIL__FROM=auth@{{ email_domains.updates }}

roles/docker/templates/gotify-compose.yml.j2

@@ -11,7 +11,6 @@ services:
     labels:
       mag37.dockcheck.update: true
     extra_hosts:
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
       - "{{ subdomains.gotify_assistant }}:{{ docker.hairpin_ip }}"
 
   igotify-assistant:
@@ -27,7 +26,6 @@ services:
     labels:
       mag37.dockcheck.update: true
     extra_hosts:
-      - "{{ subdomains.auth }}:{{ docker.hairpin_ip }}"
       - "{{ subdomains.gotify }}:{{ docker.hairpin_ip }}"
 
 volumes: