Wire Authelia SSO into Immich, Audiobookshelf, and Beszel

_authelia_provision_oidc_client gains an optional PKCE flag (new 5th
positional arg; every existing caller updated to pass "n", producing an
identical client block to before) — Audiobookshelf and Beszel's own
Authelia integration docs both require require_pkce/pkce_challenge_method,
which Authelia doesn't turn on by default.

immich.sh: _immich_offer_authelia_oidc() is real server-side automation,
not just paste-in instructions — confirmed the exact system-config "oauth"
JSON field names against Immich's own config-file.md and source (not
guessed, closing out the "needs one more verification pass" note this
repo's own CLAUDE.md already had on file). GET/PUT exchange the whole
config object, so it round-trips everything else unchanged. Needs an
admin API key that doesn't exist until first web-UI visit, so it's wired
into both the fresh-install path and the "update" rerun path.

audiobookshelf.sh, beszel.sh: both apps' OIDC config is UI-only (checked
against audiobookshelf.org and beszel.dev directly — no config API or env
var for the provider fields), so their new offers automate the Authelia
side and print exact paste-in values. Beszel also gets a real, separate
DISABLE_PASSWORD_AUTH/USER_CREATION toggle to fully replace its login,
gated behind a warning to register a working account first.

Also adds Audiobookshelf and Beszel as presets in authelia.sh's own
generic "Register another app" menu, and updates CLAUDE.md's OIDC
verification table to match reality (Immich now wired, Audiobookshelf
was wrongly listed as "high-confidence no", Beszel added).

services/audiobookshelf.sh

@@ -198,6 +198,59 @@ fi
 
 register_service audiobookshelf media "Audiobook & podcast server (Audiobookshelf)" 13378
 
+# Offers to register Audiobookshelf as an Authelia OIDC client and prints
+# exactly what to paste into its own settings — checked against
+# audiobookshelf.org's own OIDC docs directly: config lives entirely in
+# Settings -> Authentication in the app's UI, no env var or config API to
+# automate the app side with (unlike Mealie/ActualBudget/Immich), so this
+# only automates the Authelia half. Its own Authelia integration doc
+# (authelia.com) requires PKCE — the fifth arg to
+# _authelia_provision_oidc_client below.
+_audiobookshelf_offer_authelia_oidc() {
+    declare -F _authelia_provision_oidc_client >/dev/null 2>&1 || return 0
+    [ -d "$DOCKER_DIR/authelia" ] || return 0
+
+    echo ""
+    local USE_SSO=""
+    prompt_yn "  Add \"Sign in with Authelia\" (OpenID Connect) to Audiobookshelf? (y/n):" "n" USE_SSO
+    [[ "$USE_SSO" =~ ^[Yy]$ ]] || return 0
+
+    local APP_DOMAIN
+    APP_DOMAIN="$(_authelia_pick_domain "Domain Audiobookshelf is reachable at (number or domain)")"
+    if [ -z "$APP_DOMAIN" ]; then
+        log_warning "No domain entered — skipping SSO setup."
+        return 0
+    fi
+
+    local _2fa="" AUTH_POLICY="two_factor"
+    prompt_yn "  Require two-factor for Audiobookshelf logins via Authelia too? (y/n):" "y" _2fa
+    [[ "$_2fa" =~ ^[Yy]$ ]] || AUTH_POLICY="one_factor"
+
+    if ! _authelia_provision_oidc_client "Audiobookshelf" "audiobookshelf" "$AUTH_POLICY" "y" "y" \
+        "https://${APP_DOMAIN}/auth/openid/callback" "https://${APP_DOMAIN}/auth/openid/mobile-redirect" "audiobookshelf://oauth"; then
+        log_warning "Couldn't register Audiobookshelf as an OIDC client in Authelia — skipping SSO setup."
+        return 0
+    fi
+
+    echo ""
+    echo "  Audiobookshelf -> Settings -> Authentication -> enable OpenID Connect"
+    echo "  Authentication, then fill in (it wants individual endpoints, not a"
+    echo "  discovery URL):"
+    echo "    Issuer URL:      ${OIDC_AUTHELIA_PORTAL_URL}"
+    echo "    Authorize URL:   ${OIDC_AUTHELIA_PORTAL_URL}/api/oidc/authorization"
+    echo "    Token URL:       ${OIDC_AUTHELIA_PORTAL_URL}/api/oidc/token"
+    echo "    Userinfo URL:    ${OIDC_AUTHELIA_PORTAL_URL}/api/oidc/userinfo"
+    echo "    JWKS URL:        ${OIDC_AUTHELIA_PORTAL_URL}/jwks.json"
+    echo "    Client ID:       audiobookshelf"
+    echo "    Client Secret:   $OIDC_CLIENT_SECRET_PLAIN"
+    echo "    Signing Algorithm: RS256"
+    echo "    Allowed Mobile Redirect URIs: audiobookshelf://oauth"
+    echo ""
+    log_warning "The Client Secret above is shown once — save it now."
+
+    declare -F _authelia_scope_access >/dev/null 2>&1 && _authelia_scope_access "audiobookshelf" "$APP_DOMAIN"
+}
+
 install_audiobookshelf() {
     require_docker || return 1
 
@@ -261,6 +314,7 @@ install_audiobookshelf() {
                         ( cd "$ABS_DIR" && docker compose pull && docker compose up -d ) \
                             && log_success "Audiobookshelf image refreshed" \
                             || log_warning "Refresh failed — check: docker compose -f $ABS_DIR/docker-compose.yml logs"
+                        _audiobookshelf_offer_authelia_oidc
                         return 0
                         ;;
                     cancel)
@@ -358,6 +412,8 @@ ABS_ENV
 
     configure_caddy_for_service "Audiobookshelf${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)}" "${CONTAINER}:80" "audiobooks${INSTANCE_SUFFIX:+-$INSTANCE_SUFFIX}"
 
+    _audiobookshelf_offer_authelia_oidc
+
     write_readme "$ABS_DIR" << MD
 # Audiobookshelf${INSTANCE_SUFFIX:+ — $INSTANCE_SUFFIX}