authelia: stop hardcoding "auth." as the portal subdomain for OIDC discovery

_authelia_provision_oidc_client() gained a new out-param,
OIDC_AUTHELIA_PORTAL_URL, read back from the instance's own
configuration.yml (session.cookies[].authelia_url) — the actual source of
truth for where the portal lives — instead of every caller separately
assuming "https://auth.$domain".

install_authelia() and add_authelia_domain() both still default new
instances to "auth." as before (unchanged), but that's just a default, not
a guarantee: it's plain text in configuration.yml and gets hand-edited on
some boxes (e.g. a dedicated instance renamed to "authelia." to avoid
colliding with another instance's "auth." on a different machine). Mealie,
ActualBudget, and Gitea's native-OIDC wiring all independently hardcoded
"auth." when building their discovery URL, so a renamed portal silently
produced a discovery URL pointing at a host that doesn't serve Authelia —
surfacing as an opaque 500 during the OIDC token exchange with no useful
client-side error.

Verified the new awk parse against both a default ("auth.") and a renamed
("authelia.") cookies block before trusting it.

services/gitea.sh

@@ -220,7 +220,7 @@ _gitea_offer_authelia_sso() {
         return 0
     fi
 
-    local _discovery_url="https://auth.${OIDC_AUTHELIA_DOMAIN}/.well-known/openid-configuration"
+    local _discovery_url="${OIDC_AUTHELIA_PORTAL_URL}/.well-known/openid-configuration"
     log_info "Adding Authelia as an authentication source in Gitea..."
     if docker exec -u git gitea gitea admin auth add-oauth \
         --name authelia --provider openidConnect \