Episode 4: Vaultwarden single sign-on via Forgejo

- compose: SSO_ENABLED, SSO_AUTHORITY and the two client credentials, with the
  undocumented redirect path written down where people will look for it
- .env.example: was referenced by the README since episode 1 but never actually
  committed, so a fresh clone could not follow the quickstart
- README: the four steps, plus the debugging notes that cost the most time
  (no SSO line at startup, 404 on routes without query parameters, HEAD on the
  discovery endpoint, and the three-step member join)
- HARDENING: never copy db.sqlite3 alone while the container runs. WAL mode
  keeps recent writes in a side file, so that backup silently misses data

.env.example

@@ -0,0 +1,48 @@
+# ~$ selfhostedops — copy me:  cp .env.example .env
+# Generate secrets with:  openssl rand -hex 32
+
+# Your base domain. Services live at git.* wiki.* vault.* status.* n8n.* vpn.*
+# DNS: one wildcard A (and AAAA) record  *.ops.example.com -> your server IP
+DOMAIN=ops.example.com
+
+# Let's Encrypt notifications + expiry mails
+ACME_EMAIL=you@example.com
+
+TZ=Europe/Berlin
+
+# --- Outline ---
+OUTLINE_PG_PASSWORD=CHANGE_ME_openssl_rand_hex_32
+OUTLINE_SECRET_KEY=CHANGE_ME_openssl_rand_hex_32
+OUTLINE_UTILS_SECRET=CHANGE_ME_openssl_rand_hex_32
+# From Forgejo: Site Administration -> Applications -> OAuth2
+# Redirect URI: https://wiki.<DOMAIN>/auth/oidc.callback
+OUTLINE_OIDC_CLIENT_ID=
+OUTLINE_OIDC_CLIENT_SECRET=
+
+# --- Vaultwarden ---
+# Admin panel token (argon2 hash recommended, plain string works to start)
+VAULTWARDEN_ADMIN_TOKEN=CHANGE_ME_openssl_rand_hex_32
+# Flip to false once your team has signed up:
+VAULTWARDEN_SIGNUPS_ALLOWED=true
+# Single sign-on against your own Forgejo (episode 4).
+# From Forgejo: Site Administration -> Applications -> OAuth2 Application
+# Redirect URI must be EXACTLY: https://vault.<DOMAIN>/identity/connect/oidc-signin
+VAULTWARDEN_SSO_CLIENT_ID=
+VAULTWARDEN_SSO_CLIENT_SECRET=
+
+# --- wg-easy (optional, --profile vpn) ---
+# Generate with: docker run --rm ghcr.io/wg-easy/wg-easy wgpw 'yourpassword'
+WGEASY_PASSWORD_HASH=
+
+# --- CI (episode 2, optional: docker compose --profile ci up -d) ---
+# One shared secret registers the runner declaratively. Generate it with:
+#   openssl rand -hex 20
+# Then derive the UUID Forgejo will know it by:
+#   python3 -c 'import uuid,sys;print(uuid.UUID(bytes=sys.argv[1][:16].encode()))' <secret>
+# And register it on the Forgejo side:
+#   docker compose exec -u git forgejo forgejo forgejo-cli actions register \
+#     --name box-runner --labels docker --secret <secret>
+# A registration token copied from the web UI does NOT work here.
+RUNNER_SECRET=
+RUNNER_UUID=
+