Nix-built container using pkgs.authentik with ak entrypoint. Includes bashInteractive (ak is a bash wrapper), cacert, tzdata. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>