Add ntfy Basic auth, sign-out button, config-only credentials

- ntfy client supports HTTP Basic auth (username/password) for servers with
  access control; [ntfy] config gains username/password. Scheduler + Test Ntfy
  use it instead of the old settings-only bearer token.
- Settings page no longer has credential inputs (Apify/eBay/ntfy/Resend); they
  are managed in config.toml. Read-only status + Test buttons remain.
- Sidebar gains a Sign out button; in forward-auth mode it routes through the
  Authentik outpost sign_out so the IdP session is cleared.

internal/handlers/auth.go

@@ -49,6 +49,14 @@ func (a *App) PostLogin(w http.ResponseWriter, r *http.Request) {
 
 func (a *App) PostLogout(w http.ResponseWriter, r *http.Request) {
 	_ = a.Auth.LogOut(r.Context())
+	// In forward-auth mode, destroying only the local session is pointless: the
+	// next request still carries a valid Authentik proxy session and would be
+	// re-provisioned immediately. Send the user through the Authentik outpost
+	// sign-out so the IdP session is cleared too.
+	if a.Cfg.Auth.ForwardAuthEnabled() {
+		http.Redirect(w, r, "/outpost.goauthentik.io/sign_out", http.StatusSeeOther)
+		return
+	}
 	http.Redirect(w, r, "/login", http.StatusSeeOther)
 }