feat: rebuild xiteng.site homelab platform

authentik/blueprints/xiteng-passwordless.yaml

@@ -0,0 +1,35 @@
+version: 1
+metadata:
+  name: Xiteng - Passkey passwordless login
+entries:
+  - model: authentik_stages_identification.identificationstage
+    state: present
+    identifiers:
+      name: default-authentication-identification
+    attrs:
+      user_fields:
+        - email
+        - username
+      password_stage: null
+      captcha_stage: null
+      webauthn_stage: !Find [authentik_stages_authenticator_validate.authenticatorvalidatestage, [name, default-authentication-mfa-validation]]
+      case_insensitive_matching: true
+      show_matched_user: true
+      pretend_user_exists: true
+      enable_remember_me: false
+      enrollment_flow: null
+      recovery_flow: null
+      passwordless_flow: null
+      show_source_labels: false
+
+  # Authentik 2026.5 ships the password/MFA skip policies in its default
+  # authentication blueprint. Remove the temporary local copies if present.
+  - model: authentik_policies_expression.expressionpolicy
+    state: absent
+    identifiers:
+      name: xiteng-authentication-password-optional
+
+  - model: authentik_policies_expression.expressionpolicy
+    state: absent
+    identifiers:
+      name: xiteng-authentication-mfa-after-passkey