feat: Authelia SSO stack for auth.schwenk.online

Compose + Traefik ForwardAuth middleware, Redis sessions, SMTP via 0012.de, TOTP and ACL for consumer apps (e.g. pi.schwenk.online).

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -0,0 +1,15 @@
+# Copy to .env on the deploy host. Never commit .env.
+# SMTP values: same as ~/git/froxxxy/0012/server.env (Plesk mail)
+
+TZ=Europe/Berlin
+
+# --- Authelia crypto (generate on deploy; see README) ---
+# Prefer secret files under ./secrets/ (recommended). If you use env instead:
+# AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET=
+# AUTHELIA_SESSION_SECRET=
+# AUTHELIA_STORAGE_ENCRYPTION_KEY=
+
+# --- SMTP (0012.de Plesk) ---
+AUTHELIA_NOTIFIER_SMTP_USERNAME=admin@0012.de
+AUTHELIA_NOTIFIER_SMTP_PASSWORD=
+AUTHELIA_NOTIFIER_SMTP_SENDER=Authelia <monitor@0012.de>