immich: fix OIDC clientId, redirect logout to immich's own login page

clientId was still the placeholder "immich" instead of Authentik's actual
generated id, and the sops secret it points at (immich_oauth_client_secret)
was never declared on jupiter. Wire both up, and set endSessionEndpoint so
logout lands back on immich instead of Authentik's "logged out" page.

services/media/immich.nix

@@ -1,4 +1,4 @@
-{ pkgs, inputs, ... }:
+{ config, pkgs, inputs, ... }:
 
 # Immich photo/video library. Native nixpkgs module (not the upstream compose
 # stack) — it owns its own postgres (with the pgvector + vectorchord extensions
@@ -41,6 +41,66 @@ in
     port = 2283;
     mediaLocation = "/mnt/data/AppData/immich";
     machine-learning.enable = true;
+
+    # ⚠️ Setting `settings` at all switches immich to IMMICH_CONFIG_FILE, and
+    # that is ALL-OR-NOTHING (dist/utils/config.js: the config is
+    # `configFile ? loadFromFile(...) : metadataRepo.get(SystemConfig)` — the
+    # database copy is IGNORED, not merged). Two consequences:
+    #   1. Anything not declared here falls back to immich's DEFAULTS, not to
+    #      whatever the admin UI had. The old settings stay in the
+    #      system_metadata table, so deleting this block restores them.
+    #   2. The admin settings UI goes read-only — saving throws "Cannot update
+    #      configuration while IMMICH_CONFIG_FILE is in use". Change settings
+    #      HERE and redeploy.
+    # An unknown/misspelled key is a HARD startup failure under a config file
+    # (the same code path only logs a warning without one), so keys below are
+    # taken verbatim from `defaults` in immich's dist/config.js.
+    settings = {
+      server.externalDomain = "https://immich.mgaction.town";
+      newVersionCheck.enabled = false;   # nixpkgs pins the version, not immich
+
+      # OIDC via Authentik on neptun. The Authentik application/provider is
+      # created BY HAND in its UI — same as headscale's and headplane's, which
+      # are also separate apps (hosts/neptun/secrets.nix). Only the client
+      # secret is managed here.
+      oauth = {
+        enabled = true;
+        # Authentik's per-application issuer. Trailing slash matters: immich
+        # appends /.well-known/openid-configuration to it.
+        issuerUrl = "https://auth.mgaction.town/application/o/immich/";
+        # Authentik generates this; not a secret (it is sent in the browser
+        # redirect), so it lives here rather than in sops.
+        clientId = "FxrkWFe8keBrN83tu03UbAshSck52he2GphJDYSQ";
+        # Read at runtime via systemd LoadCredential — never lands in the
+        # world-readable /nix/store copy of the rendered config.
+        clientSecret._secret = config.sops.secrets.immich_oauth_client_secret.path;
+        scope = "openid email profile";
+        buttonText = "Login with Authentik";
+        # Existing accounts (the 2 imported users) keep working: matching is by
+        # email, so an Authentik user with the same address adopts that account
+        # rather than creating a second one.
+        autoRegister = true;
+        # Leave the password form reachable — autoLaunch would bounce straight
+        # to Authentik, locking everyone out if the OIDC app is misconfigured.
+        autoLaunch = false;
+        # Land back on immich's own login page after logout. Without this,
+        # immich falls back to the IdP's discovered end_session_endpoint
+        # (auth.service.js:320-326) and logout dumps you on Authentik's
+        # "you've been logged out" page instead. Must be an ABSOLUTE url —
+        # the config schema rejects a relative path — and mirrors immich's
+        # internal LOGIN_URL, including autoLaunch=0.
+        #
+        # Note this ends the IMMICH session only; the Authentik SSO session
+        # survives, so the next "Login with Authentik" click signs straight
+        # back in without a credential prompt. To end both, drop this line and
+        # let the IdP endpoint take over again.
+        endSessionEndpoint = "https://auth.mgaction.town/application/o/immich/end-session?post_logout_redirect_url=https://immich.mgaction.town";
+        # The mobile app can't follow a browser redirect back to a custom
+        # scheme through Authentik, so immich bounces it via this endpoint.
+        mobileOverrideEnabled = true;
+        mobileRedirectUri = "https://immich.mgaction.town/api/oauth/mobile-redirect";
+      };
+    };
     # Hardware transcoding would need the iGPU passed in explicitly, e.g.
     # accelerationDevices = [ "/dev/dri/renderD128" ]; the default [ ] means
     # PrivateDevices=yes and CPU-only transcode. The ZimaBlade's Celeron does