#48 · Migrate Planka behind Authentik SSO via Cloudflare Tunnel

Context

Planka is currently external. Bring it under the community SSO so users don't manage a separate password.

Acceptance criteria

• [ ] Planka deployed behind Authentik OIDC (Planka has built-in OIDC support since v1.16)
• [ ] Cloudflare Tunnel routes kanban.irregularchat.com to internal Planka
• [ ] First-time login auto-provisions account from OIDC claims
• [ ] Documentation in apps/planka/README.md

Technical hints

• Planka OIDC docs: https://github.com/plankanban/planka
• Heed cloudflare-tunnel rules: HTTPS scheme override, force-HTTPS exclusion for healthcheck

--- *Submit a merge request that says Closes #<this issue iid> in the description. On merge to main, the GitLab webhook will auto-award your bounty + the standard merge_pr (40 pts) to your scoreboard account. Email on commit must match your Authentik email.*