Retire Authentik now that every app logs in with Pocket ID

All of Authentik's applications (including Tailscale's tailnet login)
have moved to Pocket ID, and its only recent sign-ins were those
handovers. Drops its stack, the auth. route and DNS record, the auth
subdomain variables, Gotify's leftover hairpin entries, and the dockcheck
exclude; the docs now name Pocket ID as the SSO provider.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

todo.md

@@ -8,7 +8,7 @@
   ```
   roles/docker/tasks/
   ├── main.yml (orchestrator)
-  ├── infrastructure/ (caddy, authentik, dockge)
+  ├── infrastructure/ (caddy, pocketid, dockge)
   ├── development/ (gitea, codeserver, bytestash)
   ├── media/ (audiobookshelf, kavita, ghost, pinchflat, pinry, hoarder, manyfold)
   ├── productivity/ (paperless, baikal, syncthing, mmdl, heyform, dawarich, palmr, obsidian-livesync)
@@ -77,7 +77,7 @@
 - Implement configuration validation with proper assertions
 
 ### 10. Service dependency management
-- **Issue**: Some services depend on Authentik SSO but no startup ordering
+- **Issue**: Some services depend on Pocket ID SSO but no startup ordering
 - **Solution**: Implement dependency checking and startup ordering
 
 ### 11. Ansible best practices
@@ -137,5 +137,5 @@
 ## Notes
 - Current architecture is solid and much better organized for long-term maintainability
 - Focus on high-impact, low-effort improvements first
-- Leverage existing infrastructure (Gitea, Authentik) for automation
+- Leverage existing infrastructure (Gitea, Pocket ID) for automation
 - Template-driven approach enables future dynamic configuration