Phase 2: Docker and OIDC auth

.env.example

@@ -3,6 +3,24 @@ JELLYFIN_API_KEY=your-api-key
 # Optional if /Users works with your API key. Otherwise set the id of the Jellyfin user whose library views should be shown.
 JELLYFIN_USER_ID=
 
+# Optional Jellyseerr enrichment for the Users tab.
+JELLYSEERR_URL=https://requests.example.com
+JELLYSEERR_API_KEY=your-jellyseerr-api-key
+
+# Optional logging level for backend diagnostics.
+LOG_LEVEL=INFO
+
+# Optional SMTP settings for the Users -> message popup.
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_USERNAME=your-smtp-username
+SMTP_PASSWORD=your-smtp-password
+SMTP_FROM_ADDRESS=no-reply@example.com
+SMTP_FROM_NAME=Media Library Viewer
+SMTP_USE_TLS=true
+SMTP_USE_SSL=false
+SMTP_TIMEOUT=30
+
 SSH_HOST=media-server.example.com
 SSH_USERNAME=username
 SSH_PORT=22
@@ -12,3 +30,19 @@ REMOTE_MEDIA_ROOT=/mnt/media
 # Optional fallback prefix when REMOTE_MEDIA_ROOT mapping is not enough.
 # Example: Jellyfin gives /media/... but SSH host requires /srv/media/...
 REMOTE_PATH_PREFIX=
+
+# Authentik / OIDC
+# Backend validates every API request with a Bearer JWT.
+AUTH_ENABLED=true
+OIDC_ISSUER_URL=https://authentik.example/application/o/media-library-viewer/
+OIDC_AUDIENCE=media-library-viewer
+OIDC_JWKS_URL=
+OIDC_CLOCK_SKEW_SECONDS=30
+
+# Frontend OIDC settings (Vite build/runtime env)
+VITE_OIDC_ENABLED=true
+VITE_OIDC_ISSUER=https://authentik.example/application/o/media-library-viewer/
+VITE_OIDC_CLIENT_ID=media-library-viewer
+VITE_OIDC_SCOPE=openid profile email
+VITE_OIDC_REDIRECT_URI=http://localhost:8080/
+VITE_OIDC_POST_LOGOUT_REDIRECT_URI=http://localhost:8080/