Phase 10: Gitea OIDC login prerequisites in compose (external-only registration, auto-register, account linking); README steps

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -204,6 +204,21 @@ already existed run `./createGiteaDb.sh` once.
 Runner caveat: it holds the Docker socket, so anyone who can push a workflow can run as root on the box.
 Keep repo write access to trusted people.
 
+**Login via Authentik (Discord)** — same pattern as Jellyfin, done once:
+1. Authentik → Applications → Create with provider → name `Gitea`, slug `gitea`; **OAuth2/OpenID Provider**,
+   authorization flow implicit-consent, client type Confidential, redirect URI (strict)
+   `https://git.HOST/user/oauth2/authentik/callback`, signing key = the default certificate, scopes
+   `openid email profile` (the default profile mapping carries `preferred_username` and `groups`). Copy client ID + secret.
+2. Gitea → Site Administration → Identity & Access → Authentication Sources → Add: type **OAuth2**, name
+   **`authentik`** (must match the callback path), provider **OpenID Connect**, client ID/secret, OpenID Connect
+   Auto Discovery URL `https://auth.HOST/application/o/gitea/.well-known/openid-configuration`, tick "Skip local
+   2FA", claim name for groups `groups`, administrator group claim value `admins`. Save.
+3. compose (already set): registration only via external sources, auto-registration + account linking on,
+   username from `preferred_username`. A first Discord login creates the Gitea user with no form.
+4. Test in a private window: https://git.HOST/user/login → "Sign in with authentik" → Discord → logged in.
+   Members of `admins` become Gitea site admins on login. The local admin account stays as a fallback.
+Optional later: hide the password form (custom template) so Discord is the only visible way in.
+
 ## 5f. Live portal (`live.HOST`)
 
 React + dockview page (`live/`) behind Authentik forward-auth: every active stream is a dockable window,