ollama/open-webui: fix OIDC auth loop and session key persistence

open-webui was sending OAuth credentials via both client_secret_basic
(header) and client_secret_post (body) simultaneously, which Authelia
rejects. Setting OAUTH_TOKEN_ENDPOINT_AUTH_METHOD=client_secret_post
forces a single method and matches the updated Authelia client config.

WEBUI_SECRET_KEY is now a stable env var so watchtower image updates
no longer invalidate all user sessions.

ollama/docker-compose.yml

@@ -32,6 +32,8 @@ services:
       - OPENID_PROVIDER_URL=https://auth.kolpacksoftware.com/.well-known/openid-configuration
       - OAUTH_CLIENT_ID=open-webui
       - OAUTH_CLIENT_SECRET=${AUTHELIA_OIDC_CLIENT_SECRET_OPEN_WEBUI}
+      - OAUTH_TOKEN_ENDPOINT_AUTH_METHOD=client_secret_post
+      - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
     volumes:
       - /srv/open-webui:/app/backend/data
     depends_on: