Make stalwart a public PKCE client with account and admin callbacks

config/providers_oauth2/stalwart.yaml

@@ -2,20 +2,19 @@
 # https://mail.unkin.net in the mail namespace). Stalwart's OIDC directory
 # validates access tokens (JWT, userinfo fallback) and requires aud=stalwart
 # plus the openid+email scopes; it maps preferred_username/name from profile.
-# client_secret is read from Vault (seeded out of band), never committed.
+# public, no secret: the web UI uses PKCE; the strict redirect URIs are the control.
 name: stalwart
 authorization_flow: default-provider-authorization-implicit-consent
 invalidation_flow: default-provider-invalidation-flow
-client_type: confidential
+client_type: public
 client_id: stalwart
 launch_url: https://mail.unkin.net/
-client_secret_vault:
-  mount: kv
-  path: kubernetes/namespace/mail/default/oauth-credentials
 scope_mappings:
   - goauthentik.io/providers/oauth2/scope-openid
   - goauthentik.io/providers/oauth2/scope-email
   - goauthentik.io/providers/oauth2/scope-profile
 redirect_uris:
   - matching_mode: strict
-    url: https://mail.unkin.net/oauth2/callback
+    url: https://mail.unkin.net/account/oauth/callback
+  - matching_mode: strict
+    url: https://mail.unkin.net/admin/oauth/callback