feat: SeaweedFS 替代 MinIO，Authentik ForwardAuth，多服务升级

新增:
- SeaweedFS v4.28 替代 MinIO (域名 file.xiteng.site)
- Authentik Outpost (Uptime Kuma + SeaweedFS 独立实例)
- ForwardAuth 为 Uptime Kuma 和 SeaweedFS 提供认证
- gpu-exporter.py 监控脚本

升级:
- Traefik v3.6 → v3.7
- Authentik 固定版本 2026.5.0 + trusted proxy CIDR
- HedgeDoc PG 11 → 16，添加 OIDC 认证
- Homepage 添加 OIDC 认证

安全:
- Outpost token 迁移至 .env 引用（不再硬编码）
- .gitignore 扩展覆盖数据/缓存/旧 MinIO
- security.toml 清理注释掉的旧密钥

移除:
- MinIO（已全部迁移至 SeaweedFS）

outpost/compose.yml

@@ -0,0 +1,29 @@
+services:
+  outpost:
+    image: ghcr.io/goauthentik/proxy:2026.5.0
+    container_name: authentik-outpost
+    restart: unless-stopped
+    environment:
+      AUTHENTIK_HOST: https://auth.xiteng.site
+      AUTHENTIK_TOKEN: ${AUTHENTIK_OUTPOST_TOKEN}
+      AUTHENTIK_INSECURE: "true"
+    ports:
+      - "9002:9000"
+      - "9443:9443"
+    labels:
+      # --- Outpost 自身管理界面 ---
+      - "traefik.enable=true"
+      - "traefik.http.routers.outpost.rule=Host(`outpost.xiteng.site`)"
+      - "traefik.http.services.outpost.loadbalancer.server.port=9000"
+      - "traefik.http.routers.outpost.entrypoints=websecure"
+      - "traefik.http.routers.outpost.tls=true"
+      - "traefik.http.routers.outpost.tls.certresolver=cfresolver"
+      - "traefik.http.routers.outpost-http.rule=Host(`outpost.xiteng.site`)"
+      - "traefik.http.routers.outpost-http.service=outpost"
+      - "traefik.http.routers.outpost-http.entrypoints=web"
+    networks:
+      - homelab_net
+
+networks:
+  homelab_net:
+    external: true