Wire Authelia SSO into Immich, Audiobookshelf, and Beszel

_authelia_provision_oidc_client gains an optional PKCE flag (new 5th
positional arg; every existing caller updated to pass "n", producing an
identical client block to before) — Audiobookshelf and Beszel's own
Authelia integration docs both require require_pkce/pkce_challenge_method,
which Authelia doesn't turn on by default.

immich.sh: _immich_offer_authelia_oidc() is real server-side automation,
not just paste-in instructions — confirmed the exact system-config "oauth"
JSON field names against Immich's own config-file.md and source (not
guessed, closing out the "needs one more verification pass" note this
repo's own CLAUDE.md already had on file). GET/PUT exchange the whole
config object, so it round-trips everything else unchanged. Needs an
admin API key that doesn't exist until first web-UI visit, so it's wired
into both the fresh-install path and the "update" rerun path.

audiobookshelf.sh, beszel.sh: both apps' OIDC config is UI-only (checked
against audiobookshelf.org and beszel.dev directly — no config API or env
var for the provider fields), so their new offers automate the Authelia
side and print exact paste-in values. Beszel also gets a real, separate
DISABLE_PASSWORD_AUTH/USER_CREATION toggle to fully replace its login,
gated behind a warning to register a working account first.

Also adds Audiobookshelf and Beszel as presets in authelia.sh's own
generic "Register another app" menu, and updates CLAUDE.md's OIDC
verification table to match reality (Immich now wired, Audiobookshelf
was wrongly listed as "high-confidence no", Beszel added).

services/beszel.sh

@@ -251,6 +251,80 @@ _beszel_configure_agent() {
         || log_warning "Agent failed to start — check: docker compose -f $dir/docker-compose.yml logs beszel-agent"
 }
 
+# Registers Beszel as an Authelia OIDC client and prints exactly what to
+# paste into the hub's own settings. Checked against beszel.dev's own OAuth
+# docs directly: Beszel is PocketBase-based, and its OAuth2 provider config
+# is a PocketBase admin-UI setting (Settings -> Auth providers), not
+# something exposed by any documented API or env var — so, like
+# Audiobookshelf, this only automates the Authelia half. Beszel's own
+# Authelia integration doc (authelia.com) requires PKCE.
+#
+# Args: DIR (the .env holding DISABLE_PASSWORD_AUTH/USER_CREATION lives there)
+_beszel_offer_authelia_oidc() {
+    local dir="$1"
+    declare -F _authelia_provision_oidc_client >/dev/null 2>&1 || return 0
+    [ -d "$DOCKER_DIR/authelia" ] || return 0
+
+    echo ""
+    local USE_SSO=""
+    prompt_yn "  Add \"Sign in with Authelia\" (OpenID Connect) to Beszel? (y/n):" "n" USE_SSO
+    [[ "$USE_SSO" =~ ^[Yy]$ ]] || return 0
+
+    local APP_DOMAIN
+    APP_DOMAIN="$(_authelia_pick_domain "Domain Beszel is reachable at (number or domain)")"
+    if [ -z "$APP_DOMAIN" ]; then
+        log_warning "No domain entered — skipping SSO setup."
+        return 0
+    fi
+
+    local _2fa="" AUTH_POLICY="two_factor"
+    prompt_yn "  Require two-factor for Beszel logins via Authelia too? (y/n):" "y" _2fa
+    [[ "$_2fa" =~ ^[Yy]$ ]] || AUTH_POLICY="one_factor"
+
+    if ! _authelia_provision_oidc_client "Beszel" "beszel" "$AUTH_POLICY" "y" "y" \
+        "https://${APP_DOMAIN}/api/oauth2-redirect"; then
+        log_warning "Couldn't register Beszel as an OIDC client in Authelia — skipping SSO setup."
+        return 0
+    fi
+
+    echo ""
+    echo "  In the hub: Settings -> Auth providers -> OpenID Connect:"
+    echo "    Client ID:      beszel"
+    echo "    Client Secret:  $OIDC_CLIENT_SECRET_PLAIN"
+    echo "    Auth URL:       ${OIDC_AUTHELIA_PORTAL_URL}/api/oidc/authorization"
+    echo "    Token URL:      ${OIDC_AUTHELIA_PORTAL_URL}/api/oidc/token"
+    echo "    User Info URL:  ${OIDC_AUTHELIA_PORTAL_URL}/api/oidc/userinfo"
+    echo ""
+    log_warning "The Client Secret above is shown once — save it now."
+
+    declare -F _authelia_scope_access >/dev/null 2>&1 && _authelia_scope_access "beszel" "$APP_DOMAIN"
+
+    # DISABLE_PASSWORD_AUTH/USER_CREATION are real, documented env vars
+    # (beszel.dev's own OAuth guide) — but Beszel has no default account:
+    # the FIRST person to register becomes admin (see this file's own
+    # README section), and there's no signup-fallback like Mealie's
+    # OIDC_SIGNUP_ENABLED convenience wording to lean on if that hasn't
+    # happened yet. Off by default and gated behind an explicit warning —
+    # flipping this before a working login exists risks locking the hub's
+    # UI out with no account able to reach it at all.
+    echo ""
+    local _disable_local=""
+    prompt_yn "  Also disable Beszel's own password login, so Authelia is the only way in? Only do this AFTER you've registered a working account. (y/n):" "n" _disable_local
+    if [[ "$_disable_local" =~ ^[Yy]$ ]]; then
+        local _auto_register=""
+        prompt_yn "  Auto-create Beszel accounts for new Authelia logins? (y/n):" "n" _auto_register
+        sed -i '/^DISABLE_PASSWORD_AUTH=/d; /^USER_CREATION=/d' "$dir/.env"
+        {
+            echo "DISABLE_PASSWORD_AUTH=true"
+            [[ "$_auto_register" =~ ^[Yy]$ ]] && echo "USER_CREATION=true"
+        } >> "$dir/.env"
+        chown "$ACTUAL_USER:$ACTUAL_USER" "$dir/.env" 2>/dev/null || true
+        ( cd "$dir" && docker compose up -d beszel ) \
+            && log_success "Beszel's own password login is now disabled — Authelia is the only way in." \
+            || log_warning "Restart failed — check: docker compose -f $dir/docker-compose.yml logs beszel"
+    fi
+}
+
 install_beszel() {
     require_docker || return 1
     log_info "Installing Beszel..."
@@ -286,6 +360,7 @@ install_beszel() {
                     prompt_yn "  The agent was never connected — set it up now? (y/n):" "y" FINISH_AGENT
                     [[ "$FINISH_AGENT" =~ ^[Yy]$ ]] && _beszel_configure_agent "$DIR" "http://localhost:${_WP}  (or its Caddy domain, once configured)"
                 fi
+                _beszel_offer_authelia_oidc "$DIR"
                 return 0
                 ;;
             cancel)
@@ -423,6 +498,8 @@ BESZEL_ENV
 
     _beszel_configure_agent "$DIR" "http://localhost:${WEB_PORT}  (or its Caddy domain, once configured)"
 
+    _beszel_offer_authelia_oidc "$DIR"
+
     write_readme "$DIR" << 'BESZEL_README'
 # Beszel — lightweight server + Docker monitoring