Episode 4: Vaultwarden single sign-on via Forgejo

- compose: SSO_ENABLED, SSO_AUTHORITY and the two client credentials, with the
  undocumented redirect path written down where people will look for it
- .env.example: was referenced by the README since episode 1 but never actually
  committed, so a fresh clone could not follow the quickstart
- README: the four steps, plus the debugging notes that cost the most time
  (no SSO line at startup, 404 on routes without query parameters, HEAD on the
  discovery endpoint, and the three-step member join)
- HARDENING: never copy db.sqlite3 alone while the container runs. WAL mode
  keeps recent writes in a side file, so that backup silently misses data

compose.yml

@@ -126,6 +126,24 @@ services:
       DOMAIN: https://vault.${DOMAIN}
       ADMIN_TOKEN: ${VAULTWARDEN_ADMIN_TOKEN}
       SIGNUPS_ALLOWED: "${VAULTWARDEN_SIGNUPS_ALLOWED:-true}"  # set to false after your team joined!
+      # --- Single sign-on via your own Forgejo (episode 4) ---
+      # Create the OAuth2 app in Forgejo FIRST: Site Administration ->
+      # Applications -> OAuth2. Its redirect URI must be exactly:
+      #   https://vault.${DOMAIN}/identity/connect/oidc-signin
+      # That path is not documented in the UI. Getting it wrong fails only
+      # AFTER the Forgejo login, which is why it costs people twenty minutes.
+      SSO_ENABLED: "true"
+      # Just the base URL. Vaultwarden reads Forgejo's discovery document
+      # (/.well-known/openid-configuration) from here on the first login.
+      SSO_AUTHORITY: https://git.${DOMAIN}
+      SSO_CLIENT_ID: ${VAULTWARDEN_SSO_CLIENT_ID}
+      SSO_CLIENT_SECRET: ${VAULTWARDEN_SSO_CLIENT_SECRET}
+      # Vaultwarden prepends "openid" itself, so listing it here again shows up
+      # duplicated on the Forgejo consent screen. Harmless, but untidy.
+      SSO_SCOPES: "profile email"
+      # Attach an SSO login to the existing account with the same mail address
+      # instead of creating a duplicate. Turn this on BEFORE people log in.
+      SSO_SIGNUPS_MATCH_EMAIL: "true"
     volumes:
       - vaultwarden_data:/data
     networks: [proxy]