Add OpenID Connect SSO with optional authentik blueprint

- SSO_* settings (login only, master password still decrypts the vault)
- optional authentik blueprint: provider with authorization_code/refresh_token grants, application and an email mapping with email_verified, which vaultwarden requires to link SSO logins to existing accounts
- blueprints are copied into the authentik container, it only applies files from /blueprints

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

templates/opt/vaultwarden/.env.j2

@@ -19,6 +19,19 @@ ADMIN_TOKEN='{{ vaultwarden_admin_token }}'
 {% endif %}
 
 
+### SSO ###
+SSO_ENABLED={{ vaultwarden_sso_enabled | bool | lower }}
+{% if vaultwarden_sso_enabled | bool %}
+SSO_ONLY={{ vaultwarden_sso_only | bool | lower }}
+SSO_SIGNUPS_MATCH_EMAIL={{ vaultwarden_sso_signups_match_email | bool | lower }}
+SSO_AUTHORITY={{ vaultwarden_sso_authority }}
+SSO_SCOPES="{{ vaultwarden_sso_scopes }}"
+SSO_PKCE=true
+SSO_CLIENT_ID={{ vaultwarden_sso_client_id }}
+SSO_CLIENT_SECRET='{{ vaultwarden_sso_client_secret }}'
+{% endif %}
+
+
 ### SMTP ###
 SMTP_HOST={{ vaultwarden_smtp_host }}
 SMTP_PORT={{ vaultwarden_smtp_port }}