docs(grimmory): correct Authentik OIDC setup notes

OIDC config migrated from Booklore DB dump — Confidential client (not
PKCE), credentials intact. offline_access scope added to Authentik
provider. Backchannel logout URL set to permanent IP 192.168.8.213.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

containers/130-grimmory.md

@@ -36,16 +36,15 @@ Credentials live in `/opt/grimmory/.env` (untracked):
 
 ## Authentik OIDC
 
-Grimmory uses **PKCE (Public client — no client secret required)**.
+Uses Confidential client (client secret stored in Grimmory's DB — migrated from Booklore). The OIDC config carried over in the database dump; no manual re-entry needed.
 
-- **Authentik provider:** `Grimmory` (updated from old `Booklore` provider — client type changed to Public)
+- **Authentik provider:** `Provider for Grimmory` (renamed from `Provider for Booklore` on migration)
+- **Client ID:** `L1u0eFsNhbKgiIvvFeIr2mvZdbtFyzidCq2h6thL`
+- **Client type:** Confidential (client secret in `oidc_provider_details` in MariaDB `app_settings`)
 - **Redirect URI:** `https://books.hubris.network/oauth2-callback`
 - **Scopes:** openid, profile, email, offline_access
 - **Back-channel logout:** `http://192.168.8.213:6060/api/v1/auth/oidc/backchannel-logout`
-- **Grimmory admin UI:** Settings → Authentication → OIDC
-  - Issuer URI: `https://auth.hubris.network/application/o/<slug>/` (trailing slash required)
-  - Client ID: from Authentik provider
-  - Test Connection to verify reachability from within the container
+- **Application slug:** `booklore` → Issuer URI: `https://auth.hubris.network/application/o/booklore/`
 
 ## Media permissions