Add Authentik SSO, fix Uptime Kuma duplicate, enable SSO on Jellyseerr, and improve documentation

- Add Authentik service stack to infrastructure.yml
  - Includes Authentik server, worker, PostgreSQL database, and Redis
  - Alternative SSO with web UI for user management
  - Access at authentik.${DOMAIN}
  - Protected by Authelia SSO (comment out to use standalone)

- Fix Uptime Kuma duplicate listing
  - Remove from utilities.yml
  - Keep only in monitoring.yml where it belongs
  - Add Traefik labels and SSO protection to monitoring instance

- Enable SSO on Jellyseerr by default
  - Changed from bypass to protected (security-first approach)
  - Users can comment out SSO if needed for public access

- Update SSO toggling documentation
  - Emphasize commenting out (not removing) middleware line
  - Add docker command examples for running from outside stack folder
  - Show both "cd to directory" and "full path" methods
  - Add examples for starting and stopping services multiple ways

- Enhance security-first methodology
  - Update copilot instructions to default SSO to enabled
  - Only Plex and Jellyfin bypass SSO by default
  - All other services start secured, expose gradually
  - Emphasize commenting (not removing) for easier re-enable

- Update services-reference.md
  - Add Authentik to infrastructure section (12 services)
  - Move Uptime Kuma to monitoring section (8 services)
  - Remove from utilities (now 6 services)
  - Update Jellyseerr SSO status from ✗ to ✓
  - Improve Authentik documentation with deployment guidance

- Add Authentik environment variables to .env.example
  - AUTHENTIK_SECRET_KEY, DB credentials
  - Generation instructions included

All changes align with security-first principle: start secure, expose services only when ready for deployment.

Co-authored-by: kelinfoxy <67766943+kelinfoxy@users.noreply.github.com>

docs/quick-reference.md

@@ -11,25 +11,53 @@
 ### Service Management
 
 ```bash
-# Start all services in a compose file
-docker compose -f docker-compose/infrastructure.yml up -d
+# Start all services in a compose file (from stack directory)
+cd /opt/stacks/stack-name/
+docker compose up -d
 
-# Start specific service
-docker compose -f docker-compose/infrastructure.yml up -d service-name
+# Start all services (from anywhere, using full path)
+docker compose -f /opt/stacks/stack-name/docker-compose.yml up -d
 
-# Stop all services
-docker compose -f docker-compose/infrastructure.yml down
+# Start specific service (from stack directory)
+cd /opt/stacks/stack-name/
+docker compose up -d service-name
 
-# Stop specific service
-docker compose -f docker-compose/infrastructure.yml stop service-name
+# Start specific service (from anywhere)
+docker compose -f /opt/stacks/stack-name/docker-compose.yml up -d service-name
 
-# Restart service
-docker compose -f docker-compose/file.yml restart service-name
+# Stop all services (from stack directory)
+cd /opt/stacks/stack-name/
+docker compose down
 
-# Remove service and volumes
-docker compose -f docker-compose/file.yml down -v
+# Stop all services (from anywhere)
+docker compose -f /opt/stacks/stack-name/docker-compose.yml down
+
+# Stop specific service (from stack directory)
+cd /opt/stacks/stack-name/
+docker compose stop service-name
+
+# Stop specific service (from anywhere)
+docker compose -f /opt/stacks/stack-name/docker-compose.yml stop service-name
+
+# Restart service (from stack directory)
+cd /opt/stacks/stack-name/
+docker compose restart service-name
+
+# Restart service (from anywhere)
+docker compose -f /opt/stacks/stack-name/docker-compose.yml restart service-name
+
+# Remove service and volumes (from stack directory)
+cd /opt/stacks/stack-name/
+docker compose down -v
+
+# Remove service and volumes (from anywhere)
+docker compose -f /opt/stacks/stack-name/docker-compose.yml down -v
 ```
 
+**Note:** There's more than one way to manage containers - use whichever is most convenient:
+- Navigate to `/opt/stacks/stack-name/` and use short commands
+- Use full paths with `-f` flag from anywhere in the system
+
 ### Monitoring
 
 ```bash