Add Authentik sign-in, fix tab scroll insets, and polish multi-account auth.

Mobile app detects SSO per server, supports OAuth sign-in, and preserves saved
sessions when adding accounts. Tab screens get proper chrome layout and tab-bar
clearance with scrollable page headers.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/auth-capabilities.ts

@@ -0,0 +1,21 @@
+export type AuthCapabilities = {
+  authentik: boolean;
+  signupsDisabled: boolean;
+};
+
+const DEFAULT_CAPABILITIES: AuthCapabilities = {
+  authentik: false,
+  signupsDisabled: false,
+};
+
+export async function fetchAuthCapabilities(apiUrl: string): Promise<AuthCapabilities> {
+  const base = apiUrl.replace(/\/$/, "");
+
+  try {
+    const response = await fetch(`${base}/api/auth/capabilities`);
+    if (!response.ok) return DEFAULT_CAPABILITIES;
+    return (await response.json()) as AuthCapabilities;
+  } catch {
+    return DEFAULT_CAPABILITIES;
+  }
+}