Add ntfy Basic auth, sign-out button, config-only credentials

- ntfy client supports HTTP Basic auth (username/password) for servers with
  access control; [ntfy] config gains username/password. Scheduler + Test Ntfy
  use it instead of the old settings-only bearer token.
- Settings page no longer has credential inputs (Apify/eBay/ntfy/Resend); they
  are managed in config.toml. Read-only status + Test buttons remain.
- Sidebar gains a Sign out button; in forward-auth mode it routes through the
  Authentik outpost sign_out so the IdP session is cleared.

internal/scheduler/scheduler.go

@@ -489,8 +489,7 @@ func (s *Scheduler) sendNotification(ctx context.Context, it models.Item, r apif
 	if v, _ := s.store.GetSetting(ctx, "ntfy_base_url"); v != "" {
 		baseURL = v
 	}
-	token, _ := s.store.GetSetting(ctx, "ntfy_token")
-	client := ntfy.NewWithToken(baseURL, token)
+	client := ntfy.NewWithBasicAuth(baseURL, s.cfg.Ntfy.Username, s.cfg.Ntfy.Password)
 	return client.Send(ctx, ntfy.Notification{
 		Topic:    topic,
 		Title:    fmt.Sprintf("Veola Alert: %s", it.Name),