Let OIDC app registration pick a domain from Caddy too, not just type it

_authelia_add_oidc_client()'s "what domain is this app on" prompt only
ever took typed text (with a guessed SITE_DOMAIN-based default) even
though _authelia_protect_site already offered a numbered pick-from-
Caddy-or-type-a-domain UX for the equivalent question elsewhere in
this same file -- an inconsistency a user flagged directly after
registering Mealie's OIDC client and getting a plain text prompt where
they expected the same numbered list.

Factored the shared part into _authelia_pick_domain(): lists this
box's local Caddy sites by number, or accepts a typed domain
(including one not on this box's Caddy at all). Echoes the chosen
domain on stdout with the listing itself on stderr, verified separable
under $(...) capture before wiring it in. Used now by the OIDC domain
prompt; _authelia_protect_site/_authelia_unprotect_site keep their own
inline listing since they additionally annotate each site's current
protection status, which this shared version doesn't need to know
about.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SpKTLpwAgZNooTacWeQLuc

services/authelia.sh

@@ -899,6 +899,39 @@ remove_authelia_domain() {
     fi
 }
 
+# Lists this box's local Caddy sites by number for convenience, then lets
+# the caller pick one OR just type a domain directly — including one not on
+# this box's Caddy at all, since this only ever offers the list, never
+# requires picking from it. Shared by every prompt in this file that needs
+# "a domain, ideally from Caddy" (protecting/un-protecting a site, and the
+# OIDC "what domain is this app on" prompt) so they behave the same way
+# instead of each re-implementing their own version of "type it out fully."
+# Echoes the chosen domain on stdout (empty if nothing entered); the
+# listing itself goes to stderr so it never ends up captured by a caller
+# using $(...) to grab the echoed domain.
+_authelia_pick_domain() {
+    local prompt_label="$1"
+    local caddy_file="$DOCKER_DIR/caddy/Caddyfile"
+    local -a site_domains
+    [ -f "$caddy_file" ] && mapfile -t site_domains < <(grep -oE '^[A-Za-z0-9][A-Za-z0-9.-]*\.[A-Za-z]{2,} \{$' "$caddy_file" | sed 's/ {$//')
+
+    if [ "${#site_domains[@]}" -gt 0 ]; then
+        echo "  Local Caddy sites on this box:" >&2
+        local i
+        for i in "${!site_domains[@]}"; do
+            echo "    $((i + 1))) ${site_domains[$i]}" >&2
+        done
+        echo "  Or type a domain directly — including one on a different box's Caddy." >&2
+    fi
+    local choice=""
+    prompt_text "  ${prompt_label}:" "" choice
+    if [[ "$choice" =~ ^[0-9]+$ ]] && [ "$choice" -ge 1 ] && [ "$choice" -le "${#site_domains[@]}" ]; then
+        echo "${site_domains[$((choice - 1))]}"
+    else
+        echo "$choice"
+    fi
+}
+
 # Generalizes the "Protect X with Authelia SSO?" prompt individual services
 # (magicmirror, wolf-pair, security-dashboard, etc.) each offer on their own
 # install into one menu action here: pick any existing LOCAL Caddy site by
@@ -2364,9 +2397,8 @@ _authelia_add_oidc_client() {
     # ActualBudget after nothing more than a first attempt, with no way
     # through except hand-editing configuration.yml.
 
-    local APP_DOMAIN_DEFAULT="" APP_DOMAIN=""
+    local APP_DOMAIN
-    [ -n "${SITE_DOMAIN:-}" ] && [ "$SITE_DOMAIN" != "example.com" ] && APP_DOMAIN_DEFAULT="${CLIENT_ID}.${SITE_DOMAIN}"
+    APP_DOMAIN="$(_authelia_pick_domain "Domain ${APP_NAME} is reachable at (number or domain)")"
-    prompt_text "  Domain ${APP_NAME} is reachable at [${APP_DOMAIN_DEFAULT:-required}]:" "$APP_DOMAIN_DEFAULT" APP_DOMAIN
     if [ -z "$APP_DOMAIN" ]; then
         log_warning "No domain entered — nothing to do."
         return 0