feat: SeaweedFS 替代 MinIO，Authentik ForwardAuth，多服务升级

新增:
- SeaweedFS v4.28 替代 MinIO (域名 file.xiteng.site)
- Authentik Outpost (Uptime Kuma + SeaweedFS 独立实例)
- ForwardAuth 为 Uptime Kuma 和 SeaweedFS 提供认证
- gpu-exporter.py 监控脚本

升级:
- Traefik v3.6 → v3.7
- Authentik 固定版本 2026.5.0 + trusted proxy CIDR
- HedgeDoc PG 11 → 16，添加 OIDC 认证
- Homepage 添加 OIDC 认证

安全:
- Outpost token 迁移至 .env 引用（不再硬编码）
- .gitignore 扩展覆盖数据/缓存/旧 MinIO
- security.toml 清理注释掉的旧密钥

移除:
- MinIO（已全部迁移至 SeaweedFS）

hedgedoc/compose.yml

@@ -1,8 +1,10 @@
 services:
-  db:
-    image: postgres:11.6-alpine
-    env_file:
-      - ../.env
+  hedgedoc-db:
+    image: postgres:16-alpine
+    environment:
+      - POSTGRES_USER=$POSTGRES_USER
+      - POSTGRES_PASSWORD=$POSTGRES_PASSWORD
+      - POSTGRES_DB=$POSTGRES_DB
     container_name: hedgedoc_db
     restart: unless-stopped
     volumes:
@@ -14,17 +16,32 @@ services:
     image: quay.io/hedgedoc/hedgedoc:latest
     container_name: hedgedoc
     restart: unless-stopped
-    env_file:
-      - ../.env
     environment:
+      - CMD_DB_HOST=hedgedoc_db
+      - CMD_DB_PORT=5432
+      - CMD_DB_DATABASE=$POSTGRES_DB
+      - CMD_DB_USERNAME=$POSTGRES_USER
+      - CMD_DB_PASSWORD=$POSTGRES_PASSWORD
+      - CMD_DB_DIALECT=postgres
       - CMD_DOMAIN=notes.xiteng.site
       - CMD_URL_ADDPORT=false
       - CMD_ALLOW_ORIGIN=localhost,notes.xiteng.site
       - CMD_PROTOCOL_USESSL=true
+      - CMD_OAUTH2_PROVIDERNAME=Authentik
+      - CMD_OAUTH2_CLIENT_ID=hedgedoc-280baa8d
+      - CMD_OAUTH2_CLIENT_SECRET=0630f01b111d4ad68ff9b2d174028994decb5b55b51a4556bda24768d11b4586
+      - CMD_OAUTH2_AUTHORIZATION_URL=https://auth.xiteng.site/application/o/authorize/
+      - CMD_OAUTH2_TOKEN_URL=https://auth.xiteng.site/application/o/token/
+      - CMD_OAUTH2_USER_PROFILE_URL=https://auth.xiteng.site/application/o/userinfo/
+      - CMD_OAUTH2_SCOPE=openid profile email
+      - CMD_OAUTH2_ISSUER=https://auth.xiteng.site/application/o/hedgedoc/
+      - CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR=preferred_username
+      - CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR=name
+      - CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR=email
     volumes:
       - ./uploads:/hedgedoc/public/uploads
     depends_on:
-      - db
+      - hedgedoc-db
     ports:
       - "3000:3000"
     labels: