authelia: stop hardcoding "auth." as the portal subdomain for OIDC discovery

_authelia_provision_oidc_client() gained a new out-param,
OIDC_AUTHELIA_PORTAL_URL, read back from the instance's own
configuration.yml (session.cookies[].authelia_url) — the actual source of
truth for where the portal lives — instead of every caller separately
assuming "https://auth.$domain".

install_authelia() and add_authelia_domain() both still default new
instances to "auth." as before (unchanged), but that's just a default, not
a guarantee: it's plain text in configuration.yml and gets hand-edited on
some boxes (e.g. a dedicated instance renamed to "authelia." to avoid
colliding with another instance's "auth." on a different machine). Mealie,
ActualBudget, and Gitea's native-OIDC wiring all independently hardcoded
"auth." when building their discovery URL, so a renamed portal silently
produced a discovery URL pointing at a host that doesn't serve Authelia —
surfacing as an opaque 500 during the OIDC token exchange with no useful
client-side error.

Verified the new awk parse against both a default ("auth.") and a renamed
("authelia.") cookies block before trusting it.

services/authelia.sh

@@ -1694,6 +1694,19 @@ _authelia_remove_oidc_client() {
 #                              caller must capture and use/display it now.
 #   OIDC_AUTHELIA_DOMAIN       this Authelia instance's apex domain, for
 #                              building discovery/authorization/token URLs.
+#   OIDC_AUTHELIA_PORTAL_URL   the actual login-portal base URL (e.g.
+#                              https://auth.example.com) — read back from this
+#                              instance's own config rather than assumed,
+#                              since the portal subdomain isn't always "auth."
+#                              (install_authelia()/add_authelia_domain() both
+#                              default to it, but it's plain text in
+#                              configuration.yml and gets hand-edited on some
+#                              boxes — e.g. a dedicated VPS instance renamed
+#                              to "authelia." to avoid colliding with another
+#                              instance's "auth." on a different machine).
+#                              Use this, not a hardcoded "https://auth.$domain",
+#                              when building a discovery/redirect URL for a
+#                              native-OIDC app.
 # Returns 1 on failure (Authelia not installed, domain undeterminable,
 # secret generation failed) with the reason already logged. A client_id
 # that's already registered is NOT a failure — it gets replaced (see the
@@ -1704,6 +1717,7 @@ _authelia_provision_oidc_client() {
 
     OIDC_CLIENT_SECRET_PLAIN=""
     OIDC_AUTHELIA_DOMAIN=""
+    OIDC_AUTHELIA_PORTAL_URL=""
 
     local AUTHELIA_DIR="$DOCKER_DIR/authelia"
     local CONFIG_FILE="$AUTHELIA_DIR/config/configuration.yml"
@@ -1728,6 +1742,13 @@ _authelia_provision_oidc_client() {
         return 1
     fi
 
+    # Read the real portal URL back from config instead of assuming the
+    # "auth." prefix — see the OIDC_AUTHELIA_PORTAL_URL out-param comment
+    # above for why this can't be hardcoded. Falls back to the "auth."
+    # default only if parsing somehow comes up empty.
+    OIDC_AUTHELIA_PORTAL_URL="$(awk '/^  cookies:$/{f=1; next} f && /authelia_url:/{print $2; exit}' "$CONFIG_FILE")"
+    [ -z "$OIDC_AUTHELIA_PORTAL_URL" ] && OIDC_AUTHELIA_PORTAL_URL="https://auth.${OIDC_AUTHELIA_DOMAIN}"
+
     # A stale registration (e.g. from the interactive "Register an app" menu
     # run previously without ever finishing — its plaintext secret was shown
     # once and is gone, so the registration is dead weight either way) would