Caddy: /logout on every gated host redirects to Authentik sign-out

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -275,7 +275,8 @@ Design: **Authentik authenticates once for the whole domain; Caddy authorizes pe
    copyparty additionally requires a header with a secret name that only Caddy adds (`idp-h-key`,
    `COPYPARTY_IDP_KEY` in `.env`), so identity headers cannot be forged even if copyparty were reached directly.
    Logout: copyparty's logout link, the live portal's "Sign out" and the dock's "sign out" go through
-   `/outpost.goauthentik.io/sign_out`. Set the provider's **Invalidation flow** to
+   `/outpost.goauthentik.io/sign_out`; `https://<any gated host>/logout` does the same from anywhere
+   (e.g. from the Syncthing UI, which has no logout of its own). Set the provider's **Invalidation flow** to
    `default-provider-invalidation-flow` so that also ends the Authentik login: every logout then forces a full
    Discord re-login on the next visit (and picks up group changes). Discord itself may approve silently if
    you are still logged into Discord in that browser.

configure.py

@@ -127,7 +127,9 @@ def ask_name(kind, taken):
         return n
 
 # ------------------------------------------------------------------ writers
-AUTHENTIK_FORWARD_AUTH = """	# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
+AUTHENTIK_FORWARD_AUTH = """	# /logout on every gated host = sign out of the Discord login (domain-wide session)
+	redir /logout /outpost.goauthentik.io/sign_out 302
+	# Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the
 	# whole domain (recommended) or single-application for this host — assigned to the embedded outpost.
 	# Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups.
 	reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000