Add Authelia SSO, remove authentik, restrict ultralytics port

- Add authelia/ stack: Authelia 4.38 + Redis 7-alpine on isolated
  authelia-internal bridge; Authelia also on npm-network for NPM
  forward-auth. Secrets via env vars (not committed).
- Add authelia/config/configuration.yaml: file-based users, SQLite
  storage, one_factor policy for *.kolpacksoftware.com
- Add **/users_database.yaml to .gitignore (host-only secret)
- Remove authentik/ (non-functional leftover)
- ultralytics: bind port 8501 to 127.0.0.1 only (auth enforced via NPM)

ultralytics/docker-compose.yml

@@ -13,7 +13,7 @@ services:
         --server.headless true --server.address 0.0.0.0 --server.port 8501
         -- /data/models/yolo11x_leaf.pt
     ports:
-      - "8501:8501"
+      - "127.0.0.1:8501:8501"
     volumes:
       - /srv/ultralytics/data:/data
       - /srv/ultralytics/runs:/root/runs