Move Paperless login from Authentik to Pocket ID

Pocket ID was added as a second allauth provider first, so the existing
account could be connected from the Paperless profile page. With that
done, the Authentik provider is removed. Its credentials stay in the
vault for rollback.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/paperlessngx-compose.yml.j2

@@ -30,7 +30,7 @@ services:
       - ./consume:/usr/src/paperless/consume
     env_file: docker-compose.env
     extra_hosts:
-      - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
+      - '{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}'
     environment:
       PAPERLESS_REDIS: redis://broker:6379
       PAPERLESS_TIKA_ENABLED: 1

roles/docker/templates/paperlessngx.env.j2

@@ -41,6 +41,6 @@ PAPERLESS_TIME_ZONE=America/Denver
 #PAPERLESS_FORCE_SCRIPT_NAME=/PATHPREFIX
 #PAPERLESS_STATIC_URL=/PATHPREFIX/static/ # trailing slash required
 
-# authentik
+# OIDC login via Pocket ID
 PAPERLESS_APPS: "allauth.socialaccount.providers.openid_connect"
-PAPERLESS_SOCIALACCOUNT_PROVIDERS: '{"openid_connect": {"APPS": [{"provider_id": "authentik","name": "Authentik SSO","client_id": "{{ vault_paperlessngx.oidc.client_id }}","secret": "{{ vault_paperlessngx.oidc.client_secret }}","settings": { "server_url": "https://{{ subdomains.auth }}/application/o/paperlessngx/.well-known/openid-configuration"}}]}}'
+PAPERLESS_SOCIALACCOUNT_PROVIDERS: '{"openid_connect": {"APPS": [{"provider_id": "pocketid","name": "Pocket ID","client_id": "{{ vault_paperlessngx.pocketid.client_id }}","secret": "{{ vault_paperlessngx.pocketid.client_secret }}","settings": { "server_url": "https://{{ subdomains.pocketid }}/.well-known/openid-configuration"}}]}}'