Working NixOS port: all core services operational

- Fix Caddy cfProxy helper for cloudflared http:// vhosts (X-Forwarded-Proto)
- Fix Authelia LDAP bind (readonly user ACL + password sync)
- Add gitea-admin-setup oneshot service to survive rebuilds
- Update Authelia forward_auth with header_up X-Forwarded-Proto https
- Update TODO.org with completed tasks and LDAP config details
- Remove old Helm/k8s artifacts (Chart.yaml, templates/, values/, scripts)
- Add result to .gitignore

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/services/authelia.nix

@@ -23,7 +23,7 @@ let
   dataDir = config.homey.storage.mountPoint;
   domain  = homeyConfig.domain;
 
-  # LDAP base DN derived from domain: home.zakobar.com → dc=home,dc=zakobar,dc=com
+  # LDAP base DN derived from domain: zakobar.com → dc=zakobar,dc=com
   ldapBaseDN = lib.concatStringsSep ","
     (map (p: "dc=${p}") (lib.splitString "." domain));
 
@@ -162,7 +162,7 @@ in
     virtualisation.oci-containers.containers.authelia = {
       image = cfg.image;
 
-      ports = [ "127.0.0.1:${toString cfg.port}:9091" ];
+      # No ports mapping — --network=host shares the host network stack directly.
 
       environment = {
         TZ = homeyConfig.timezone;