Let a home deployment hold its own Authentik session

A home site forwarded every identity route to auth_base_url, so it never knew
who was visiting and could only ever offer "Sign in". It now runs the OIDC
flow itself and shows "My Account" and, for admins, "Admin" -- both pointing
at the deployment that owns those pages.

There is no user table on a home deployment, so the session cookie carries the
claims we need (username, email, admin flag) rather than a row id. It is
HMAC-signed, so it is tamper-evident, and holds nothing secret. The admin test
mirrors upsert_oidc_user: app_admin_emails or an admin group in the claims.

Also decouples oidc_issuer from auth_base_url. They are different hosts --
Authentik on one, the accounts app on another -- and deriving one from the
other only worked when they happened to coincide. OIDC_ISSUER is now its own
variable, required unless APP_ROLE=home.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/oidc.py

@@ -92,6 +92,7 @@ def groups_from_claims(claims: dict[str, Any]) -> set[str]:
 
 def logout_url(config: Config) -> str:
     provider = discover(config)
-    endpoint = provider.end_session_endpoint or f"{config.auth_base_url}/if/session-end/"
+    # Authentik advertises {issuer}/end-session/; fall back to that shape if discovery omits it.
+    endpoint = provider.end_session_endpoint or f"{config.oidc_issuer}/end-session/"
     query = urllib.parse.urlencode({"post_logout_redirect_uri": config.base_url})
     return f"{endpoint}?{query}"