Episode 4: Vaultwarden single sign-on via Forgejo

- compose: SSO_ENABLED, SSO_AUTHORITY and the two client credentials, with the
  undocumented redirect path written down where people will look for it
- .env.example: was referenced by the README since episode 1 but never actually
  committed, so a fresh clone could not follow the quickstart
- README: the four steps, plus the debugging notes that cost the most time
  (no SSO line at startup, 404 on routes without query parameters, HEAD on the
  discovery endpoint, and the three-step member join)
- HARDENING: never copy db.sqlite3 alone while the container runs. WAL mode
  keeps recent writes in a side file, so that backup silently misses data

HARDENING.md

@@ -58,6 +58,20 @@ apt install -y fail2ban   # default ssh jail is enough to start
 
 - `VAULTWARDEN_SIGNUPS_ALLOWED=false` the moment your team is on board.
 - Use an argon2 `ADMIN_TOKEN` (`vaultwarden hash` / see wiki), not a plain string.
+  A plain one makes Vaultwarden print a NOTICE on every start. It is telling
+  the truth.
+- **Never back up `db.sqlite3` on its own while the container runs.** The
+  database is in WAL mode: recent writes live in `db.sqlite3-wal` and are not
+  in the main file yet. Copy it alone and you get a backup that silently
+  misses your newest users and entries, and you find out on restore day.
+  Either stop the container first (see section 7), or take a consistent copy:
+
+```bash
+docker compose exec vaultwarden sh -c "sqlite3 /data/db.sqlite3 \".backup '/data/backup.sqlite3'\""
+```
+
+- Restore the backup somewhere else, once, before you trust it. A backup you
+  have never restored is a belief, not a backup.
 - The admin panel (`/admin`) is for setup — consider blocking it in Caddy afterwards:
 
 ```
@@ -89,7 +103,7 @@ Plus: enable your provider's server snapshots. Two clicks, saves your company.
 
 ## 8. What this list is NOT
 
-Not covered here, on purpose (own episodes): SSO everywhere, 2FA enforcement
+Not covered here, on purpose (own episodes): 2FA enforcement
 per service, Netbird zero-trust mesh, central logging, CrowdSec, offsite borg.
 Baseline first. Perfect later.