Deploy: drop the interim basic-auth gate now that Petal signs people in

The gate existed because Petal authenticated nobody and a public hostname
was therefore a public, writable API. It no longer is: every /api route
answers 401 without a session, so the only thing an anonymous visitor
reaches is the app shell and its redirect to Authentik. The separate
unauthenticated /api/health router goes with it — it only existed to escape
the middleware. A second password in front of a real login is one more
thing to lose.

Also records the two problems this deployment actually hit, since both fail
before the login page appears and neither is obvious from the error: the
issuer's trailing slash is significant, and a provider created through the
API rather than the admin UI comes up with an empty grant_types.

Claude-Session: https://claude.ai/code/session_016y6gyuHkQXPiEuW8RGQyua

docker-compose.yml

@@ -79,23 +79,14 @@ services:
       traefik.http.routers.petal.tls: "true"
       traefik.http.routers.petal.tls.certResolver: default
       traefik.http.routers.petal.service: petal
-      traefik.http.routers.petal.middlewares: compression@file,petal-headers,petal-auth
+      # No edge gate: Petal authenticates for itself now (Authentik OIDC), so
+      # every /api route answers 401 without a session and the only thing served
+      # to an anonymous visitor is the app shell and its sign-in redirect. The
+      # basic-auth middleware that stood here until Phase 16 — plus the separate
+      # unauthenticated router /api/health needed to escape it — is gone; a
+      # second password in front of a real login is just one more thing to lose.
+      traefik.http.routers.petal.middlewares: compression@file,petal-headers
       traefik.http.services.petal.loadbalancer.server.port: "8080"
-      # INTERIM — delete this middleware and the petal-health router when Phase
-      # 16's OIDC login lands. Petal has no authentication of its own yet
-      # (StaticResolver hands every request the same local user), so without a
-      # gate at the edge anyone who finds the hostname can read and write
-      # documents and upload images. PETAL_BASIC_AUTH is a user:bcrypt-hash
-      # pair; see deploy/README.md for generating it.
-      traefik.http.middlewares.petal-auth.basicauth.users: ${PETAL_BASIC_AUTH:?set PETAL_BASIC_AUTH in .env}
-      # /api/health stays open on its own higher-priority router: a monitoring
-      # probe must not need a credential, and the endpoint carries no user data.
-      traefik.http.routers.petal-health.rule: Host(`${PETAL_HOST:-petal.parodia.dev}`) && Path(`/api/health`)
-      traefik.http.routers.petal-health.priority: "100"
-      traefik.http.routers.petal-health.entrypoints: web-secure
-      traefik.http.routers.petal-health.tls: "true"
-      traefik.http.routers.petal-health.tls.certResolver: default
-      traefik.http.routers.petal-health.service: petal
       # Petal is a private writing space: no framing, no sniffing, HSTS on.
       traefik.http.middlewares.petal-headers.headers.customresponseheaders.Content-Security-Policy: frame-ancestors 'self'
       traefik.http.middlewares.petal-headers.headers.customresponseheaders.Strict-Transport-Security: max-age=31536000; includeSubDomains