immich: fix OIDC clientId, redirect logout to immich's own login page

clientId was still the placeholder "immich" instead of Authentik's actual
generated id, and the sops secret it points at (immich_oauth_client_secret)
was never declared on jupiter. Wire both up, and set endSessionEndpoint so
logout lands back on immich instead of Authentik's "logged out" page.

hosts/jupiter/secrets.nix

@@ -26,4 +26,12 @@
   # Headscale pre-auth key for tailscale auto-registration (see configuration.nix).
   sops.secrets.tailscale_authkey = { };
 
+  # Immich's OIDC client secret, from its Authentik application (a SEPARATE
+  # app from headscale's and headplane's — see hosts/neptun/secrets.nix).
+  # Referenced as settings.oauth.clientSecret._secret in
+  # services/media/immich.nix; the module resolves it through systemd
+  # LoadCredential, which reads as root before dropping privileges, so the
+  # sops default of root:root 0400 is correct — do NOT set `owner`.
+  sops.secrets.immich_oauth_client_secret = { };
+
 }