Add Authelia SSO, remove authentik, restrict ultralytics port

- Add authelia/ stack: Authelia 4.38 + Redis 7-alpine on isolated
  authelia-internal bridge; Authelia also on npm-network for NPM
  forward-auth. Secrets via env vars (not committed).
- Add authelia/config/configuration.yaml: file-based users, SQLite
  storage, one_factor policy for *.kolpacksoftware.com
- Add **/users_database.yaml to .gitignore (host-only secret)
- Remove authentik/ (non-functional leftover)
- ultralytics: bind port 8501 to 127.0.0.1 only (auth enforced via NPM)

authelia/docker-compose.yml

@@ -0,0 +1,33 @@
+services:
+  authelia:
+    container_name: authelia
+    image: authelia/authelia:4.38
+    restart: unless-stopped
+    volumes:
+      - /srv/authelia/config:/config
+    environment:
+      - TZ=America/New_York
+      - AUTHELIA_JWT_SECRET=${AUTHELIA_JWT_SECRET}
+      - AUTHELIA_SESSION_SECRET=${AUTHELIA_SESSION_SECRET}
+      - AUTHELIA_STORAGE_ENCRYPTION_KEY=${AUTHELIA_STORAGE_ENCRYPTION_KEY}
+    networks:
+      - npm-network
+      - authelia-internal
+    depends_on:
+      - authelia-redis
+
+  authelia-redis:
+    container_name: authelia-redis
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: --save 60 1 --loglevel warning
+    volumes:
+      - /srv/authelia/redis:/data
+    networks:
+      - authelia-internal
+
+networks:
+  npm-network:
+    external: true
+  authelia-internal:
+    driver: bridge