The internal-CA identity.k8s.syd1.au.unkin.net host has no CA bundle
mounted in the jellyfin pods, so discovery fetch fails TLS handshake.
Authentik's discovery response is host-relative, so the endpoint must
be the publicly-trusted hostname browsers can also reach.
- Change OidEndpoint to identity.unkin.net in fafflix and cheeztv plugin config