feat: SeaweedFS 替代 MinIO，Authentik ForwardAuth，多服务升级

新增:
- SeaweedFS v4.28 替代 MinIO (域名 file.xiteng.site)
- Authentik Outpost (Uptime Kuma + SeaweedFS 独立实例)
- ForwardAuth 为 Uptime Kuma 和 SeaweedFS 提供认证
- gpu-exporter.py 监控脚本

升级:
- Traefik v3.6 → v3.7
- Authentik 固定版本 2026.5.0 + trusted proxy CIDR
- HedgeDoc PG 11 → 16，添加 OIDC 认证
- Homepage 添加 OIDC 认证

安全:
- Outpost token 迁移至 .env 引用（不再硬编码）
- .gitignore 扩展覆盖数据/缓存/旧 MinIO
- security.toml 清理注释掉的旧密钥

移除:
- MinIO（已全部迁移至 SeaweedFS）

seaweedfs/compose.yml

@@ -0,0 +1,60 @@
+services:
+  seaweedfs:
+    image: chrislusf/seaweedfs:latest
+    container_name: seaweedfs
+    restart: unless-stopped
+    command: "server -s3 -s3.port=8333 -master.port=9333 -volume.port=8080 -filer -filer.port=8888 -dir=/data -s3.domainName=file.xiteng.site"
+    environment:
+      - WEED_SECURITY_CONFIG=/etc/seaweedfs/security.toml
+    volumes:
+      - ./data:/data
+      - ./security.toml:/etc/seaweedfs/security.toml:ro
+    ports:
+      - "9333:9333"   # master
+      - "8081:8080"   # volume
+      - "8888:8888"   # filer
+      - "8333:8333"   # s3
+    labels:
+      - "traefik.enable=true"
+      # --- Traefik: S3 Console (带 Authentik ForwardAuth) ---
+      - "traefik.http.routers.minio.rule=Host(`file.xiteng.site`)"
+      - "traefik.http.services.minio.loadbalancer.server.port=8888"
+      - "traefik.http.routers.minio.entrypoints=websecure"
+      - "traefik.http.routers.minio.tls=true"
+      - "traefik.http.routers.minio.tls.certresolver=cfresolver"
+      - "traefik.http.routers.minio-http.rule=Host(`file.xiteng.site`)"
+      - "traefik.http.routers.minio-http.service=minio"
+      - "traefik.http.routers.minio-http.entrypoints=web"
+      # --- ForwardAuth：显式转发 Cookie 头给 outpost ---
+      - "traefik.http.middlewares.minio-scheme.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.middlewares.minio-auth.forwardauth.address=http://authentik-outpost-seaweedfs:9000/outpost.goauthentik.io/auth/traefik"
+      - "traefik.http.middlewares.minio-auth.forwardauth.trustForwardHeader=true"
+      - "traefik.http.middlewares.minio-auth.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name"
+      - "traefik.http.routers.minio.middlewares=minio-scheme,minio-auth"
+      - "traefik.http.routers.minio-http.middlewares=minio-scheme,minio-auth"
+      # --- Traefik: S3 API (8333) ---
+      - "traefik.http.routers.minio-api.rule=Host(`minio-api.xiteng.site`)"
+      - "traefik.http.services.minio-api.loadbalancer.server.port=8333"
+      - "traefik.http.routers.minio-api.entrypoints=websecure"
+      - "traefik.http.routers.minio-api.tls=true"
+      - "traefik.http.routers.minio-api.tls.certresolver=cfresolver"
+      - "traefik.http.routers.minio-api-http.rule=Host(`minio-api.xiteng.site`)"
+      - "traefik.http.routers.minio-api-http.service=minio-api"
+      - "traefik.http.routers.minio-api-http.entrypoints=web"
+      # --- Homepage ---
+      - "homepage.group=我的服务"
+      - "homepage.name=SeaweedFS"
+      - "homepage.icon=/icons/seaweedfs-local.png"
+      - "homepage.href=https://file.xiteng.site"
+      - "homepage.description=对象存储"
+      # --- AutoKuma ---
+      - "kuma.minio.http.name=SeaweedFS"
+      - "kuma.minio.http.url=http://seaweedfs:8888"
+      - "kuma.minio.http.interval=60"
+      - "kuma.minio.http.max_retries=3"
+    networks:
+      - homelab_net
+
+networks:
+  homelab_net:
+    external: true

seaweedfs/security.toml

@@ -0,0 +1,3 @@
+# Homelab Security Configuration
+# All JWT sections are commented out — filer UI auth is handled by Authentik ForwardAuth.
+# See README.md for architecture details.