Add ntfy Basic auth, sign-out button, config-only credentials

- ntfy client supports HTTP Basic auth (username/password) for servers with
  access control; [ntfy] config gains username/password. Scheduler + Test Ntfy
  use it instead of the old settings-only bearer token.
- Settings page no longer has credential inputs (Apify/eBay/ntfy/Resend); they
  are managed in config.toml. Read-only status + Test buttons remain.
- Sidebar gains a Sign out button; in forward-auth mode it routes through the
  Authentik outpost sign_out so the IdP session is cleared.

internal/config/config.go

@@ -126,6 +126,11 @@ type ActorConfig struct {
 type NtfyConfig struct {
 	BaseURL      string `toml:"base_url"`
 	DefaultTopic string `toml:"default_topic"`
+	// Username/Password authenticate publishes via HTTP Basic auth, for ntfy
+	// servers with access control (auth-default-access: deny-all). Leave both
+	// empty for an open server.
+	Username string `toml:"username"`
+	Password string `toml:"password"`
 }
 
 type SchedulerConfig struct {