headscale: add OIDC login, stop overriding clients' local DNS

Two changes to the control server, plus the fallout on the hosts.

OIDC via Authentik, so `tailscale up --login-server ...` opens a browser
instead of needing a pre-auth key. This is a second Authentik application,
separate from headplane's, with headscale's own /oidc/callback redirect.
Headless hosts keep using pre-auth keys. Note that headscale runs OIDC
discovery at startup and a failure is FATAL -- pointing `issuer` at an
application that does not exist yet means the control server will not
boot, so verify the discovery document before deploying.

override_local_dns = false, because the upstream default of true replaces
resolv.conf with 100.100.100.100 on every node. That silently broke the
LAN's `.sol` names -- pihole serves those and the global nameservers
return NXDOMAIN for them -- and took ad blocking down with them. It also
made each node's entire DNS depend on tailscaled, which is what had
forced --accept-dns=false onto neptun and mercury individually; both of
those workarounds are now removed, and with MagicDNS resolving properly
again neptun no longer needs its hardcoded /etc/hosts pin for jupiter.

Also serves jellyfin and seerr from jupiter, matching the ports they
already use on its LAN vhosts, and rotates the tailnet pre-auth keys.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hosts/mercury/configuration.nix

@@ -28,19 +28,9 @@
   networking.interfaces.eth0.ipv6.addresses = [
     { address = "fd18:df17:9078:0::10"; prefixLength = 64; }
   ];
-  # VERIFY with `ip route` on the Pi — assuming the router is .1.
   networking.defaultGateway = { address = "10.0.0.1"; interface = "eth0"; };
-  # Resolvers for the Pi's OWN lookups (not the LAN service). Kept public so the
-  # host resolves during boot without depending on its own pihole/unbound.
   networking.nameservers = [ "1.1.1.1" "9.9.9.9" ];
 
-  # Never take MagicDNS on THIS host. headscale pushes override_local_dns, so
-  # accepting it would repoint mercury's resolv.conf at 100.100.100.100 and
-  # make the LAN's DNS server depend on tailscaled to resolve anything — the
-  # same boot-time DNS deadlock this host already hit once (see CLAUDE.md),
-  # except a failure here takes the whole network's DNS down with it.
-  services.tailscale.extraUpFlags = [ "--accept-dns=false" ];
-
   # ---- pihole web admin password (from sops) ----
   # The pihole container reads FTLCONF_* env vars. Render an env file from the
   # sops secret and feed it to the container — password stays out of repo/store.