Add ntfy Basic auth, sign-out button, config-only credentials

- ntfy client supports HTTP Basic auth (username/password) for servers with
  access control; [ntfy] config gains username/password. Scheduler + Test Ntfy
  use it instead of the old settings-only bearer token.
- Settings page no longer has credential inputs (Apify/eBay/ntfy/Resend); they
  are managed in config.toml. Read-only status + Test buttons remain.
- Sidebar gains a Sign out button; in forward-auth mode it routes through the
  Authentik outpost sign_out so the IdP session is cleared.

config.toml.example

@@ -70,9 +70,15 @@ client_secret    = ""
 environment      = "production"
 daily_call_limit = 5000
 
+# ntfy push notifications. If the server has access control
+# (auth-default-access: deny-all), set username/password to an ntfy user that
+# has write access to the topics you publish to; Veola authenticates publishes
+# with HTTP Basic auth. Leave both blank for an open server.
 [ntfy]
 base_url      = "https://ntfy.yourdomain.com"
 default_topic = "veola"
+username      = ""
+password      = ""
 
 # Resend transactional email (https://resend.com) for opt-in deal alerts and
 # the weekly digest. api_key and from can also be set via /settings. The from