Authentik (local)
Configure Authentik for local Google SSO.
Authentik runs in Compose and backs OIDC for the app. See docs/auth/ in the repository for provider URLs, redirect URIs, and environment variables (AUTHENTIK_*).
- Redirect URI must match NUXT auth callback URL
- Enable Google as a social login source in Authentik
- Session cookies require correct SITE_URL / host for localhost
