Basking: sign in with Authentik only, pages that nest and link

Sign-in is now OpenID Connect against Authentik (authorization code flow
with PKCE, state and nonce). The password, API tokens and the add command
are gone; each person who signs in gets a private notebook in a folder
named from a hash of who they are. An optional allowed list is checked on
every request.

Notes become pages with titles, a tree of subpages, [[links]] with
backlinks that follow renames, a Ctrl+K finder, slash commands, list
continuation, and Write and Read modes. Autosave keeps the text through a
dropped connection or an expired session. Export opens as an Obsidian vault.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

deploy/docker-compose.yml

@@ -1,10 +1,17 @@
-# Basking. Reach it through a reverse proxy or Hammerhead (HTTPS), and set "cookie_secure": true
-# and "trust_proxy": true in basking.json when you do.
+# Basking, a private notebook you sign in to with Authentik. Reach it through an HTTPS reverse proxy
+# (or Hammerhead) that forwards to 127.0.0.1:8490, and give Authentik the redirect URI
+# https://notes.example.com/auth/callback (use your own address).
 services:
   basking:
     image: git.veillax.com/veillax/basking:latest   # or: build: ..
     restart: unless-stopped
     ports:
       - "127.0.0.1:8490:8490"
+    environment:
+      BASKING_PUBLIC_URL: https://notes.example.com
+      BASKING_OIDC_ISSUER: https://auth.example.com/application/o/basking/
+      BASKING_OIDC_CLIENT_ID: change-me
+      BASKING_OIDC_CLIENT_SECRET: change-me
+      # BASKING_ALLOWED: you@example.com   # optional: limit who may sign in
     volumes:
-      - ./config:/config       # basking.json and data/ (your notes) live here
+      - ./config:/config       # basking.json (the signing secret) and data/ (your pages) live here