v0.2 foundation — Authentik OIDC + sulkta-mariadb DB + Fernet crypto

Adds the multi-user plumbing layer underneath v0.1's batch-only API:

- DB module (db.py) — PyMySQL against sulkta-mariadb, in-process migrations.
  Tables: cauldron_users, cauldron_user_mealie_tokens, cauldron_chat_log,
  schema_migrations.
- Crypto module (crypto.py) — thin Fernet wrapper. Master key in env,
  per-row encryption of stored Mealie tokens, decrypt only in-process.
- OIDC module (oidc.py) — Authlib-based Authentik integration. Issuer
  https://auth.sulkta.com/application/o/cauldron/, sub_mode=user_email,
  scopes openid+email+profile. App gated to 'Sulkta Family' group.
- Two-tier Mealie shape — system_mealie (env token, admin batch) +
  current_user_mealie() helper that loads + decrypts the calling user's
  token from DB. Per the v0.2 design (memory/spec-cauldron-v0.2.md).
- Connect flow — /connect-mealie pages walk users through minting their
  own Mealie API token and pasting it back. Validated against
  /api/users/self before encryption + storage.
- Routes — /, /login, /auth/callback, /logout, /me, /connect-mealie,
  /disconnect-mealie. v0.1 admin endpoints kept under bearer auth.
- Mealie.who_am_i() helper added.
- Auth flow uses Authentik subject (sub) as the canonical user key.

UI is minimal — connect-mealie page uses the locked palette
(forest #1f2d1f, panels #2d3a2a, meadow #6b8e5a/#88a87a, parchment text
#f0e6cc/#ddd4ba) and Cormorant Garamond serif headers. Strict palette.
The fuller dashboard / plan / list / recipes views land in subsequent
commits.

Authentik provider PK 24, client_id ZIwEugWWWZinR1KcVC9IT9hpGoTds9ps8XDDHPPN.
Group 'Sulkta Family' (pk 6d0c75e9-...) created with cobb member.

Foundation only — Abby's branded UI and the meal-plan / shopping-list
features land in subsequent v0.2 commits.

.env.example

@@ -19,5 +19,22 @@ CLAWDFORGE_TOKEN=
 DEFAULT_MODEL=sonnet
 DEFAULT_TIMEOUT_SECS=120
 
-# Local dev/admin bearer (used until Authentik OIDC lands in v0.2)
-ADMIN_BEARER=change-me-this-is-the-cauldron-api-token
+# Admin bearer for batch ops (sterilize-all, etc.) — separate from user OIDC
+ADMIN_BEARER=change-me-this-is-the-cauldron-admin-batch-token
+
+# Authentik OIDC (provisioned 2026-04-28; client_id + secret minted by Authentik)
+OIDC_ISSUER=https://auth.sulkta.com/application/o/cauldron/
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+OIDC_REDIRECT_URI=http://192.168.0.5:7790/auth/callback
+
+# DB (sulkta-mariadb on the sulkta bridge)
+DB_HOST=sulkta-mariadb
+DB_PORT=3306
+DB_NAME=cauldron
+DB_USER=cauldron_app
+DB_PASSWORD=
+
+# Fernet master key for at-rest encryption of per-user Mealie tokens.
+# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+CAULDRON_FERNET_KEY=