Requests to /share/* are optionally redirected to Immich Public Proxy
for public access without going through Authelia, and without exposing
the whole Immich service.
Fixes#656
- Declarative SSO setup via json config file
- roleClaim via LDAP groups to automatically set admin privileges
- SSO tested manually, but not yet in playwright test
- Storage quota claim not yet implemented
- Authelia rule prevents access by non-members of
userGroup/adminUserGroup
