Add Authentik OIDC login, ollama-auth LAN proxy, and asr/tts sidecar wiring

- open-webui: OIDC-only auth via Authentik (password/local login disabled),
  account linking by email
- ollama: GPU reservation, disable idle unload, read-only GGUF import mount
- ollama-auth: nginx bearer-token proxy in front of ollama for LAN access
- docker-compose.audio.yaml + docker-stack.sh: wrap base/gpu/audio compose
  files so asr/tts sidecars (../asr-server, ../tts-server) always come up
  together with the GPU override

docker-compose-launcher.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
 
 # ---------------------------------------------------------------------------
 # Interactive docker compose launcher for Open WebUI.
@@ -100,38 +101,46 @@ done
 # ── Drop mode ─────────────────────────────────────────────────────────────────
 
 if [[ "$drop_project" == true ]]; then
-  docker compose down --remove-orphans
+  ./docker-stack.sh down --remove-orphans
   echo -e "${GREEN}${BOLD}Compose project stopped and cleaned up.${RESET}"
   exit 0
 fi
 
 # ── Build compose command ─────────────────────────────────────────────────────
+#
+# The base + GPU + audio file set is owned by docker-stack.sh (the single
+# source of truth for "what this stack always needs"), so it can't drift out
+# of sync between the two entry points the way docker-compose.audio.yaml once
+# did here. This script only ever layers its own optional extras (api/data/
+# playwright) on top and delegates the actual `docker compose` call.
 
-compose_files=("-f" "docker-compose.yaml")
-
-if [[ "$enable_gpu" == true ]]; then
-  if ! [[ "$gpu_count" =~ ^([0-9]+|all)$ ]]; then
-    echo >&2 "Error: Invalid GPU count '${gpu_count}'. Must be a number or 'all'."
-    exit 1
-  fi
+if [[ "$gpu_count" =~ ^([0-9]+|all)$ ]]; then
   export OLLAMA_GPU_DRIVER
   OLLAMA_GPU_DRIVER=$(detect_gpu_driver)
   export OLLAMA_GPU_COUNT="$gpu_count"
-  compose_files+=("-f" "docker-compose.gpu.yaml")
+elif [[ "$enable_gpu" == true ]]; then
+  echo >&2 "Error: Invalid GPU count '${gpu_count}'. Must be a number or 'all'."
+  exit 1
 fi
+# docker-stack.sh always merges docker-compose.gpu.yaml (defaults: nvidia,
+# count 1, from that file's own ${VAR-default} fallbacks) -- GPU passthrough
+# is no longer optional here, matching docker-stack.sh's behavior. --enable-gpu
+# now only customizes the driver/count via the env vars set above.
+
+extra_files=()
 
 if [[ "$enable_api" == true ]]; then
   export OLLAMA_WEBAPI_PORT="$api_port"
-  compose_files+=("-f" "docker-compose.api.yaml")
+  extra_files+=("-f" "docker-compose.api.yaml")
 fi
 
 if [[ -n "$data_dir" ]]; then
   export OLLAMA_DATA_DIR="$data_dir"
-  compose_files+=("-f" "docker-compose.data.yaml")
+  extra_files+=("-f" "docker-compose.data.yaml")
 fi
 
 if [[ "$enable_playwright" == true ]]; then
-  compose_files+=("-f" "docker-compose.playwright.yaml")
+  extra_files+=("-f" "docker-compose.playwright.yaml")
 fi
 
 export OPEN_WEBUI_PORT="$webui_port"
@@ -163,7 +172,7 @@ fi
 
 # ── Launch ────────────────────────────────────────────────────────────────────
 
-if docker compose "${compose_files[@]}" "${up_args[@]}"; then
+if ./docker-stack.sh "${extra_files[@]}" "${up_args[@]}"; then
   echo
   echo -e "${GREEN}${BOLD}${CHECK_MARK} Compose project started successfully.${RESET}"
 else