Add OpenID Connect SSO with optional authentik blueprint

- SSO_* settings (login only, master password still decrypts the vault)
- optional authentik blueprint: provider with authorization_code/refresh_token grants, application and an email mapping with email_verified, which vaultwarden requires to link SSO logins to existing accounts
- blueprints are copied into the authentik container, it only applies files from /blueprints

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/main.yml

@@ -41,3 +41,23 @@
   community.docker.docker_compose_v2:
     project_src: "{{ vaultwarden_inst }}"
     state: present
+
+- name: setup authentik blueprint for vaultwarden sso
+  template:
+    src: opt/authentik/vaultwarden-sso.yaml.j2
+    dest: "{{ vaultwarden_sso_authentik_data }}/vaultwarden-sso.yaml"
+    mode: 0600
+    owner: "1000"
+    group: "1000"
+  register: vaultwarden_sso_blueprint
+  when: vaultwarden_sso_enabled | bool and vaultwarden_sso_authentik | bool
+
+# authentik only applies blueprints from its own blueprints folder
+- name: apply authentik blueprint for vaultwarden sso
+  command:
+    cmd: "{{ item }}"
+  loop:
+    - "docker cp {{ vaultwarden_sso_authentik_data }}/vaultwarden-sso.yaml {{ vaultwarden_sso_authentik_container }}:/blueprints/custom-vaultwarden-sso.yaml"
+    - "docker exec {{ vaultwarden_sso_authentik_container }} ak apply_blueprint custom-vaultwarden-sso.yaml"
+  no_log: true
+  when: vaultwarden_sso_blueprint is changed