clientId was still the placeholder "immich" instead of Authentik's actual generated id, and the sops secret it points at (immich_oauth_client_secret) was never declared on jupiter. Wire both up, and set endSessionEndpoint so logout lands back on immich instead of Authentik's "logged out" page.