Authentik moved to charon.sticknife.com

The identity provider's hostname changed. Only AUTHENTIK_ISSUER points at it,
so the live change is one line in .env.local; this commit carries the docs and
the example, which still named the old host.

The issuer string has to match the provider's own discovery document exactly,
trailing slash and all -- a host that answers is not the same as an issuer that
validates -- so the example now says how to check it. AUTH_URL is unrelated and
stays: it is this app's address, not Authentik's.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -10,8 +10,15 @@
 DATABASE_URL=postgres://user:password@mimir/ampelos
 
 # --- sign-in --------------------------------------------------------------
+# AUTH_URL is this app's own address. The ISSUER is Authentik's, and the two
+# are unrelated -- moving the identity provider does not change AUTH_URL.
 AUTH_URL=https://ampelos.sticknife.com
-AUTHENTIK_ISSUER=
+
+# Must match the "issuer" field in the provider's own discovery document
+# exactly, trailing slash included, or the sign-in fails validation even though
+# the host answers. Check with:
+#   curl -s https://<host>/application/o/<slug>/.well-known/openid-configuration
+AUTHENTIK_ISSUER=https://charon.sticknife.com/application/o/ampelos/
 AUTHENTIK_CLIENT_ID=
 AUTHENTIK_CLIENT_SECRET=