feat: SeaweedFS 替代 MinIO，Authentik ForwardAuth，多服务升级

新增:
- SeaweedFS v4.28 替代 MinIO (域名 file.xiteng.site)
- Authentik Outpost (Uptime Kuma + SeaweedFS 独立实例)
- ForwardAuth 为 Uptime Kuma 和 SeaweedFS 提供认证
- gpu-exporter.py 监控脚本

升级:
- Traefik v3.6 → v3.7
- Authentik 固定版本 2026.5.0 + trusted proxy CIDR
- HedgeDoc PG 11 → 16，添加 OIDC 认证
- Homepage 添加 OIDC 认证

安全:
- Outpost token 迁移至 .env 引用（不再硬编码）
- .gitignore 扩展覆盖数据/缓存/旧 MinIO
- security.toml 清理注释掉的旧密钥

移除:
- MinIO（已全部迁移至 SeaweedFS）

homepage/compose.yml

@@ -5,11 +5,17 @@ services:
     restart: unless-stopped
     volumes:
       - ./config:/app/config
+      - ./config/icons:/app/public/icons:ro
       - /var/run/docker.sock:/var/run/docker.sock:ro
     ports:
       - "3003:3000"
     environment:
       - HOMEPAGE_ALLOWED_HOSTS=home.xiteng.site,xiteng.site
+      - HOMEPAGE_AUTH_PROVIDER=oidc
+      - HOMEPAGE_AUTH_OIDC_ISSUER=https://auth.xiteng.site/application/o/homepage/
+      - HOMEPAGE_AUTH_OIDC_CLIENT_ID=homepage-64bfd7a7
+      - HOMEPAGE_AUTH_OIDC_CLIENT_SECRET=b5d710941dba4a4694a92fe7bc381f3c853a248b5114467d9b82b0953928326b
+      - HOMEPAGE_AUTH_OIDC_SCOPE=openid profile email
     labels:
       # --- 1. Traefik 路由设置 ---
       - "traefik.enable=true"

homepage/gpu-exporter.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""Serve NVIDIA GPU stats as JSON for Homepage customapi widget."""
+import subprocess, json
+from http.server import HTTPServer, BaseHTTPRequestHandler
+
+class GPUHandler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        try:
+            r = subprocess.run(
+                ['nvidia-smi', '--query-gpu=utilization.gpu,memory.used,memory.total,temperature.gpu,fan.speed',
+                 '--format=csv,noheader,nounits'],
+                capture_output=True, text=True, timeout=5
+            )
+            parts = [p.strip() for p in r.stdout.strip().split(',')]
+            data = {
+                'gpu_util': parts[0] + '%',
+                'mem_used': parts[1],
+                'mem_total': parts[2],
+                'mem': f'{parts[1]} / {parts[2]} MiB',
+                'temp': parts[3] + '°C',
+                'fan': parts[4] + '%',
+            }
+        except Exception as e:
+            data = {'error': str(e)}
+
+        self.send_response(200)
+        self.send_header('Content-Type', 'application/json')
+        self.send_header('Access-Control-Allow-Origin', '*')
+        self.end_headers()
+        self.wfile.write(json.dumps(data).encode())
+
+    def log_message(self, format, *args):
+        pass  # suppress logs
+
+HTTPServer(('0.0.0.0', 9999), GPUHandler).serve_forever()