Let a home deployment hold its own Authentik session

A home site forwarded every identity route to auth_base_url, so it never knew
who was visiting and could only ever offer "Sign in". It now runs the OIDC
flow itself and shows "My Account" and, for admins, "Admin" -- both pointing
at the deployment that owns those pages.

There is no user table on a home deployment, so the session cookie carries the
claims we need (username, email, admin flag) rather than a row id. It is
HMAC-signed, so it is tamper-evident, and holds nothing secret. The admin test
mirrors upsert_oidc_user: app_admin_emails or an admin group in the claims.

Also decouples oidc_issuer from auth_base_url. They are different hosts --
Authentik on one, the accounts app on another -- and deriving one from the
other only worked when they happened to coincide. OIDC_ISSUER is now its own
variable, required unless APP_ROLE=home.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/config.py

@@ -82,10 +82,14 @@ def get_config() -> Config:
     database_url = os.environ.get("DATABASE_URL", "")
     if role != "home" and not database_url:
         raise SystemExit("DATABASE_URL is required unless APP_ROLE=home")
-    # Where the pages this deployment does not serve actually live. A "full" deployment serves
-    # them itself, so its own base URL is the right answer. The OIDC issuer defaults to the same
-    # host, so moving the auth service means changing AUTH_BASE_URL alone.
+    # Where the pages this deployment does not serve actually live -- the "full" deployment that
+    # owns registration, profile and admin. A "full" deployment serves them itself, so its own
+    # base URL is the right answer. This is NOT the identity provider: OIDC_ISSUER points at
+    # Authentik, which lives on a different host.
     auth_base_url = os.environ.get("AUTH_BASE_URL", base_url).rstrip("/")
+    oidc_issuer = os.environ.get("OIDC_ISSUER", "").rstrip("/")
+    if role != "home" and not oidc_issuer:
+        raise SystemExit("OIDC_ISSUER is required unless APP_ROLE=home")
     return Config(
         role=role,
         auth_base_url=auth_base_url,
@@ -99,7 +103,7 @@ def get_config() -> Config:
         default_ipa_group=os.environ.get("DEFAULT_IPA_GROUP", "sticknife_users"),
         app_admin_emails=_csv("APP_ADMIN_EMAILS"),
         admin_groups=_csv("APP_ADMIN_GROUPS") or {"sticknife_admins"},
-        oidc_issuer=os.environ.get("OIDC_ISSUER", f"{auth_base_url}/application/o/charon/").rstrip("/"),
+        oidc_issuer=oidc_issuer,
         oidc_client_id=os.environ.get("OIDC_CLIENT_ID", ""),
         oidc_client_secret=os.environ.get("OIDC_CLIENT_SECRET", ""),
         oidc_scopes=os.environ.get("OIDC_SCOPES", "openid profile email groups"),