Phase 10: Gitea OIDC login prerequisites in compose (external-only registration, auto-register, account linking); README steps

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

CommunityDiscordMedia.md

@@ -246,7 +246,7 @@ Checklist:
       publishes the plugin zip is the obvious first pipeline
 - risk: the runner's Docker socket is root on the host for anyone who can push a workflow
 
-### Phase 10 — Gitea login via Authentik (OIDC)  (later)
+### Phase 10 — Gitea login via Authentik (OIDC)  (compose done; Authentik + Gitea UI steps pending)
 Same pattern as Jellyfin: Authentik is the identity, Gitea trusts it.
 - [ ] Authentik → Applications → Create with provider → OAuth2/OpenID: name `gitea`, redirect
       `https://git.HOST/user/oauth2/authentik/callback`, authorization flow implicit-consent, scopes
@@ -255,11 +255,9 @@ Same pattern as Jellyfin: Authentik is the identity, Gitea trusts it.
       provider OpenID Connect, name `authentik` (must match the callback path above),
       client ID/secret, discovery URL `https://auth.HOST/application/o/<slug>/.well-known/openid-configuration`,
       "Skip local 2FA", claim mapping: group claim `groups` → Gitea admin group `admins`
-- [ ] Gitea app.ini / env: `GITEA__oauth2_client__ENABLE_AUTO_REGISTRATION=true`,
-      `GITEA__oauth2_client__ACCOUNT_LINKING=auto`, `GITEA__oauth2_client__USERNAME=nickname` so first
-      Discord login creates the Gitea user with no form (registration stays closed for local accounts)
-- [ ] optional: `GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION=true`, hide the password form on the
-      login page (`GITEA__oauth2_client__OPENID_CONNECT_SCOPES`, custom template) so Discord is the only way in
+- [x] Gitea env: `DISABLE_REGISTRATION=false` + `ALLOW_ONLY_EXTERNAL_REGISTRATION=true` (local self-signup stays
+      off), `ENABLE_AUTO_REGISTRATION`, `ACCOUNT_LINKING=auto`, `USERNAME=nickname`, `UPDATE_AVATAR`
+- [ ] optional: hide the password form on the login page (custom template) so Discord is the only visible way in
 - [ ] policy on the Authentik application: who may reach Gitea at all (e.g. `admins` + a `devs` group)
 - [ ] test with a non-admin Discord user; confirm admin mapping via `admins` group