Add Authelia SSO/MFA access service

[xrhstosmour]

What:

1. Adds a self-hosted Authelia SSO/MFA forward-auth service at security/access/authelia, following the existing docker-compose.yml + template.env pattern, with a configuration/ folder (hand-edited like Traefik's) holding configuration.yml and a placeholder users_database.yml.
2. Wires storage to the shared postgresql container and sessions to the shared redis container via Authelia's AUTHELIA_* env-var config overrides, instead of bundling its own database.
3. No depends_on on postgresql/redis (separate compose projects); Authelia's image is a minimal static binary without a confirmed shell/nc, so it relies on restart: unless-stopped to retry until they're reachable, with a comment explaining why.
4. Uses the image's own bundled /app/healthcheck.sh for the healthcheck: block (authelia healthcheck is not a real subcommand on this image, confirmed while testing).

Why:

Pre-staging SSO/MFA for a future VPS install.

Testing:

1. docker compose config validates with no errors.
2. Started the shared postgresql/redis containers locally, generated a real bcrypt hash for a test user, and confirmed Authelia connects to both, runs its storage schema check, and reaches Startup complete / healthy status.
3. curl localhost:<port>/api/health returns {"status":"OK"}, and the login UI returns 200.
4. Along the way, found that databases/postgresql's current configuration/postgresql.conf doesn't set listen_addresses, so Postgres only listens on localhost inside its container and refuses connections from other containers on the shared internal network (reproduced directly with nc from an unrelated container). Worked around this locally only to verify Authelia's wiring, then reverted the tweak, since fixing the shared Postgres config is out of scope here, flagging it to the maintainer separately since it likely also affects the existing GlitchTip/Metabase/pgAdmin4 cross-project connections.
5. docker compose down -v cleans up with no leftover state.

[xrhstosmour]

Addressed in 9704366:

1. Dropped the ###...### box-comment banners in configuration.yml/users_database.yml, plain # comments only now, matching the rest of the repo.
2. Removed the static users_database.yml placeholder entirely. The admin user is now generated on every container start from ADMIN_USERNAME/ADMIN_PASSWORD/ADMIN_EMAIL in .env, hashed with Authelia's own bundled authelia crypto hash generate bcrypt before the original entrypoint takes over (so the /config chown/privilege-drop still happens normally). No pre-generated hash to check in or replace by hand anymore.
3. Named those three vars ADMIN_* rather than AUTHELIA_ADMIN_*, since Authelia's image warns on any unrecognized AUTHELIA_*-prefixed env var (it assumes those are all config overrides).

Retested end to end: generated file has a real hash, Startup complete/healthy, and an actual /api/firstfactor login with the auto-generated credentials returns {"status":"OK"}.