Add group/site summary view; let Mealie fully hand off login to Authelia

authelia.sh: menu option 15 lists every outside-access group with its
site membership (from access_control.rules, excluding each group's own
deny-elsewhere rule) and user membership (from users.yml) in one place —
previously only visible by grepping both files by hand.

mealie.sh: _mealie_offer_authelia_oidc now offers to set
ALLOW_PASSWORD_LOGIN=false (hides Mealie's own login form) and
OIDC_AUTO_REDIRECT=true (skip the login page, go straight to Authelia),
both confirmed against docs.mealie.io rather than assumed. Off by
default since it's a real access-control change, not just an additive
SSO button — anyone without an Authelia account loses their login path.

services/mealie.sh

@@ -229,7 +229,10 @@ _mealie_offer_authelia_oidc() {
         local RECONFIGURE=""
         prompt_yn "  Reconfigure it (registers a fresh Authelia client + secret)? (y/n):" "n" RECONFIGURE
         [[ "$RECONFIGURE" =~ ^[Yy]$ ]] || return 0
-        sed -i '/^OIDC_/d' "$DIR/.env"
+        # ALLOW_PASSWORD_LOGIN isn't OIDC_-prefixed but is written by this
+        # same step (see below) — strip it too so reconfiguring doesn't
+        # leave a stale duplicate line if it's set again.
+        sed -i '/^OIDC_/d; /^ALLOW_PASSWORD_LOGIN=/d' "$DIR/.env"
     fi
 
     local BASE_URL
@@ -248,6 +251,27 @@ _mealie_offer_authelia_oidc() {
     prompt_yn "  Require two-factor for Mealie logins via Authelia too? (y/n):" "y" _2fa
     [[ "$_2fa" =~ ^[Yy]$ ]] || AUTH_POLICY="one_factor"
 
+    # Mealie's own docs document ALLOW_PASSWORD_LOGIN (hides the
+    # username+password fields entirely) and OIDC_AUTO_REDIRECT (skips the
+    # login page and jumps straight to the identity provider) as the real,
+    # supported way to make Authelia the only way in — confirmed against
+    # docs.mealie.io's OIDC and backend-config pages directly, not assumed.
+    # Off by default: this is a real access-control change (anyone who
+    # only has a local Mealie account, not an Authelia one, loses their
+    # login path), not just an additive convenience like the SSO button
+    # above. Recoverable any time by flipping these back and restarting —
+    # worth saying so, since a locked-out admin's first instinct otherwise
+    # is to worry the account itself is gone.
+    echo ""
+    local _disable_local=""
+    prompt_yn "  Also disable Mealie's own username/password login, so Authelia is the only way in? (y/n):" "n" _disable_local
+    local _auto_redirect=""
+    if [[ "$_disable_local" =~ ^[Yy]$ ]]; then
+        log_warning "Anyone without an Authelia account (only a local Mealie one) will no longer be able to log in."
+        log_info "Reversible any time: set ALLOW_PASSWORD_LOGIN back to true in $DIR/.env and 'docker compose up -d'."
+        prompt_yn "  Skip Mealie's login page entirely and jump straight to Authelia? (y/n):" "y" _auto_redirect
+    fi
+
     if ! _authelia_provision_oidc_client "Mealie" "mealie" "$AUTH_POLICY" "y" "${BASE_URL}/login"; then
         log_warning "Couldn't register Mealie as an OIDC client in Authelia — skipping SSO setup."
         return 0
@@ -265,6 +289,15 @@ OIDC_CLIENT_SECRET=$OIDC_CLIENT_SECRET_PLAIN
 OIDC_CONFIGURATION_URL=$_discovery_url
 OIDC_PROVIDER_NAME=Authelia
 ENV
+    if [[ "$_disable_local" =~ ^[Yy]$ ]]; then
+        echo "ALLOW_PASSWORD_LOGIN=false" >> "$DIR/.env"
+    fi
+    if [[ "$_auto_redirect" =~ ^[Yy]$ ]]; then
+        {
+            echo "OIDC_AUTO_REDIRECT=true"
+            echo "OIDC_REMEMBER_ME=true"
+        } >> "$DIR/.env"
+    fi
     chown "$ACTUAL_USER:$ACTUAL_USER" "$DIR/.env" 2>/dev/null || true
 
     # Mealie's OIDC redirect URI generation trusts X-Forwarded-* only from
@@ -279,8 +312,10 @@ ENV
         sed -i "/container_name: ${CONTAINER}\$/a\\    entrypoint: [\"uvicorn\", \"mealie.app:app\", \"--host\", \"0.0.0.0\", \"--port\", \"9000\", \"--forwarded-allow-ips=*\"]" "$DIR/docker-compose.yml"
     fi
 
+    local _success_msg="\"Sign in with Authelia\" added to Mealie — local login still works too."
+    [[ "$_disable_local" =~ ^[Yy]$ ]] && _success_msg="\"Sign in with Authelia\" added to Mealie — local username/password login is now disabled."
     (cd "$DIR" && docker compose up -d) \
-        && log_success "\"Sign in with Authelia\" added to Mealie — local login still works too." \
+        && log_success "$_success_msg" \
         || log_warning "Restart failed — check: docker compose -f $DIR/docker-compose.yml logs"
 
     declare -F _authelia_scope_access >/dev/null 2>&1 && _authelia_scope_access "mealie" "${BASE_URL#*://}"