Move Karakeep login from Authentik to Pocket ID

The first Pocket ID login linked to the existing account by email, then
email-based account linking was switched off so only that Pocket ID
identity can sign in. The client ID now comes from the vault instead of
being written in the template.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/hoarder-compose.yml.j2

@@ -8,7 +8,7 @@ services:
     env_file:
       - .env
     extra_hosts:
-      - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
+      - '{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}'
       - '{{ subdomains.bookmarks }}:{{ docker.hairpin_ip }}'
     environment:
       MEILI_ADDR: http://meilisearch:7700

roles/docker/templates/hoarder-env.j2

@@ -3,8 +3,8 @@ NEXTAUTH_SECRET={{ vault_hoarder.nextauth_secret }}
 MEILI_MASTER_KEY={{ vault_hoarder.meili_master_key }}
 NEXTAUTH_URL=https://{{ subdomains.bookmarks }}
 OPENAI_API_KEY={{ vault_infrastructure.openai_api_key }}
-OAUTH_CLIENT_SECRET={{ vault_hoarder.oidc.client_secret }}
-OAUTH_CLIENT_ID=GTi0QBRH5TiTqZfxfAkYSQVVFouGdlOFMc2sjivN
-OAUTH_PROVIDER_NAME=Authentik
-OAUTH_WELLKNOWN_URL=https://{{ subdomains.auth }}/application/o/hoarder/.well-known/openid-configuration
-OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true
+OAUTH_CLIENT_SECRET={{ vault_hoarder.pocketid.client_secret }}
+OAUTH_CLIENT_ID={{ vault_hoarder.pocketid.client_id }}
+OAUTH_PROVIDER_NAME=Pocket ID
+OAUTH_WELLKNOWN_URL=https://{{ subdomains.pocketid }}/.well-known/openid-configuration
+OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=false