refactor(auth): drop the unread AUTH_PROFILE key

Eleven app configs declared CFG_<APP>_AUTH_PROFILE as a "capability tier for the
WebUI auth tools". Nothing read it — not a shell script, not the frontend, and it
was never emitted into apps.json, so the WebUI could not have acted on it even in
principle.

The job it was meant to do is already done, and done better: authAdapterCanDo
tests `declare -F authAdapter_<app>_<method>`, so what an app can do is derived
from the functions it actually implements. A declared tier is a second source of
truth that can only drift — traefik declared single_password while its adapter
implements setPassword only, and linkding declared nothing at all while shipping
a full multi-user adapter, and neither mismatch had any effect.

Removed the key and its comment from all eleven configs, and replaced the stale
contract note in auth_adapter.sh with what the dispatcher really does.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

containers/adguard/adguard.config

@@ -74,7 +74,5 @@ CFG_ADGUARD_PORT_5="adguard-service|dot|random:853|disabled|tcp|false|false|fals
 CFG_ADGUARD_PORT_6="adguard-exporter|metrics|9617:9617|disabled|tcp|false|false|false|Metrics Exporter (sidecar, docker-network only)|"
 
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_ADGUARD_AUTH_PROFILE=single_password
 CFG_ADGUARD_ADMIN_USER=
 CFG_ADGUARD_ADMIN_PASSWORD_1=RANDOMIZEDPASSWORD2

containers/bookstack/bookstack.config

@@ -77,6 +77,4 @@ CFG_BOOKSTACK_NETWORK=default
 #
 CFG_BOOKSTACK_PORT_1="bookstack-service|webui|random:80|public|tcp|false|true|true|Web Interface||bookstack"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_BOOKSTACK_AUTH_PROFILE=multi_user
 CFG_BOOKSTACK_ADMIN_USER=

containers/gitea/gitea.config

@@ -67,8 +67,6 @@ CFG_GITEA_NETWORK=default
 CFG_GITEA_PORT_1="gitea-service|webui|random:3000|public|tcp|false|true|true|Web Interface||gitea"
 CFG_GITEA_PORT_2="gitea-service|ssh|random:22|private|tcp|false|false|false|Git SSH Access|"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_GITEA_AUTH_PROFILE=multi_user
 CFG_GITEA_ADMIN_USER=
 CFG_GITEA_ADMIN_EMAIL=
 #

containers/invidious/invidious.config

@@ -65,8 +65,6 @@ CFG_INVIDIOUS_NETWORK=default
 #
 CFG_INVIDIOUS_PORT_1="invidious-service|webui|random:3000|public|tcp|false|true|true|Web Interface||invidious"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_INVIDIOUS_AUTH_PROFILE=multi_user
 CFG_INVIDIOUS_ADMIN_USER=
 CFG_INVIDIOUS_ADMIN_EMAIL=
 #

containers/matrix/matrix.config

@@ -115,5 +115,3 @@ CFG_MATRIX_NETWORK=default
 CFG_MATRIX_PORT_1="matrix-synapse|homeserver|random:8008|public|tcp|false|true|false|Matrix Homeserver (client + federation API)||matrix"
 CFG_MATRIX_PORT_2="matrix-element|webui|random:80|public|tcp|false|true|true|Element Web Interface||element"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_MATRIX_AUTH_PROFILE=multi_user

containers/mattermost/mattermost.config

@@ -75,8 +75,6 @@ CFG_MATTERMOST_NETWORK=default
 #
 CFG_MATTERMOST_PORT_1="mattermost-service|webui|random:8065|public|tcp|false|true|true|Web Interface||mattermost"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_MATTERMOST_AUTH_PROFILE=multi_user
 # Email of the account the WebUI card advertises; set by whoever runs the setup
 # wizard or the create-account tool, and kept in step by the reset-password tool.
 CFG_MATTERMOST_ADMIN_EMAIL=

containers/nextcloud/nextcloud.config

@@ -29,7 +29,6 @@ CFG_NEXTCLOUD_DB_NAME=nextcloud
 CFG_NEXTCLOUD_DB_USER=nextcloud
 CFG_NEXTCLOUD_DB_PASSWORD_1=RANDOMIZEDPASSWORD2
 CFG_NEXTCLOUD_DB_ROOT_PASSWORD_1=RANDOMIZEDPASSWORD3
-CFG_NEXTCLOUD_AUTH_PROFILE=multi_user
 #
 # =============================================================================
 # METADATA

containers/rocketchat/rocketchat.config

@@ -76,5 +76,3 @@ CFG_ROCKETCHAT_NETWORK=default
 #
 CFG_ROCKETCHAT_PORT_1="rocketchat-service|webui|random:3000|public|tcp|false|true|true|Web Interface||rocketchat"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_ROCKETCHAT_AUTH_PROFILE=multi_user

containers/stalwart/stalwart.config

@@ -117,12 +117,10 @@ CFG_STALWART_PORT_7="stalwart-service|pop3s|995:995|disabled|tcp|false|false|fal
 CFG_STALWART_PORT_8="stalwart-service|sieve|4190:4190|disabled|tcp|false|false|false|ManageSieve (client-managed mail filters)|"
 CFG_STALWART_PORT_9="stalwart-service|jmap|443:443|disabled|tcp|false|false|false|HTTPS/JMAP direct — leave disabled when Traefik fronts the UI|"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
 # The password reaches the container through a compose environment variable, so
 # if you replace the generated one by hand keep it alphanumeric: docker compose
 # interpolates `$` and YAML treats ` #` as a comment, either of which would
 # silently mangle the value. The generator only emits letters and digits.
-CFG_STALWART_AUTH_PROFILE=user_password
 CFG_STALWART_ADMIN_USER=admin
 CFG_STALWART_ADMIN_PASSWORD_1=RANDOMIZEDPASSWORD1
 #

containers/stoat/stoat.config

@@ -95,7 +95,5 @@ CFG_STOAT_PORT_1="stoat-caddy|webui|random:80|public|tcp|false|true|true|Web Int
 # Not Traefik-managed — WebRTC is not HTTP.
 CFG_STOAT_PORT_2="stoat-livekit|voice-tcp|7881:7881|public|tcp|false|false|false|LiveKit voice/video (TCP fallback)|"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
 # Stoat exposes no safe way to set a password or grant a role from outside the
 # app, so these tools list and enable/disable only — see scripts/stoat_auth.sh.
-CFG_STOAT_AUTH_PROFILE=multi_user

containers/traefik/traefik.config

@@ -85,6 +85,4 @@ CFG_TRAEFIK_PORT_1="traefik-service|dashboard|random:8080|public|tcp|true|true|t
 CFG_TRAEFIK_PORT_2="traefik-service|https|443:443|public|tcp|false|false|false|HTTPS Traffic|"
 CFG_TRAEFIK_PORT_3="traefik-service|http|80:80|disabled|tcp|false|false|false|HTTP Traffic|"
 
-# AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
-CFG_TRAEFIK_AUTH_PROFILE=single_password
 CFG_TRAEFIK_ADMIN_USER=

scripts/app/auth_adapter.sh

@@ -2,14 +2,17 @@
 
 # Universal user/credential adapter for app tools.
 #
-# Each app declares an auth profile in its config:
+# An app opts in by implementing adapter functions in
-#   CFG_<APP>_AUTH_PROFILE = single_password | user_password | multi_user | none
+# containers/<app>/scripts/<app>_auth.sh:
-#
-# And implements adapter functions in containers/<app>/scripts/<app>_auth.sh:
 #   authAdapter_<app>_setPassword "$user" "$password"
 #   authAdapter_<app>_createUser  "$user" "$password" "$email" "$isAdmin"
 #   authAdapter_<app>_listUsers
 #
+# What an app can do is discovered from which of those exist (authAdapterCanDo),
+# not declared anywhere. There used to be a CFG_<APP>_AUTH_PROFILE key naming a
+# capability tier, but nothing ever read it — it was a second source of truth
+# that could only drift out of step with the functions actually implemented.
+#
 # Tool wrappers call authAdapterCall <app> <method> <args...>. The
 # dispatcher checks the function exists, runs it, and refreshes apps.json
 # via webuiPatchAppConfigJson so new admin creds surface in the WebUI.