coder: autostop TTL, nightly backups, Authelia OIDC, wildcard runbook

- docker-compose: CODER_OIDC_* wired to Authelia (password login kept as break-glass)
- scripts/backup-stacks.sh + stacks-backup.timer: nightly pg_dump, Continue state, stack configs
- vault: verification items 13/14, auth-model OIDC section, limits DNS-01 runbook

docker-compose.yml

@@ -30,6 +30,14 @@ services:
       CODER_ACCESS_URL: https://code.loca.zone
       CODER_PG_CONNECTION_URL: postgresql://coder:${CODER_PG_PASSWORD}@database:5432/coder?sslmode=disable
       CODER_TELEMETRY_ENABLE: "false"
+      # Authelia OIDC. Password login stays enabled as break-glass, so
+      # CODER_DISABLE_PASSWORD_AUTH is deliberately unset. No email-domain
+      # restriction: the Authelia user database is the gate.
+      CODER_OIDC_ISSUER_URL: https://auth.loca.zone
+      CODER_OIDC_CLIENT_ID: coder
+      CODER_OIDC_CLIENT_SECRET: ${CODER_OIDC_CLIENT_SECRET}
+      CODER_OIDC_SCOPES: openid,profile,email
+      CODER_OIDC_SIGN_IN_TEXT: "Sign in with loca.zone SSO"
       # No CODER_WILDCARD_ACCESS_URL. Nested names such as foo.code.loca.zone
       # DO resolve via the *.loca.zone wildcard; the actual blocker is TLS
       # issuance: this lineage covers only code.loca.zone and