feat: add weblink playlists, SSH player deployment, Caddy HTTPS, build player page

- Content model: add url column + is_weblink() for web page content items
- Player model: add deployment tracking fields (status, timestamps, message)
- Content blueprint: add add_weblink and add_weblink_to_playlist routes;
  weblinks auto-deleted when removed from playlist
- Players blueprint: add SSH deploy mode in add_player; weblink-aware playlist
- API blueprint: weblink URL served directly in playlist response;
  add /api/deploy/test-ssh and /api/deploy/player endpoints
- Admin blueprint: add build-player page (clone from Gitea, write base config);
  replace nginx status card with Caddy status on HTTPS config page
- caddy_manager: rewritten to generate proper HTTPS/internal-CA Caddyfiles
  and reload Caddy via admin API (/load) for live config updates
- ssh_deploy, background_tasks, player_build: new utils for SSH deployment
- background_tasks: push Flask app context into background thread so DB
  updates after deployment complete correctly
- ssh_deploy: robust install script detection with passwordless sudo injection
  (uses SSH credentials, cleaned up after install)
- Dockerfile: add git, sshpass, openssh-client, rsync
- docker-compose: switch nginx to Caddy on ports 80/443; add port 5000 for dev
- Templates: add_player deploy mode UI, weblink form in playlist/upload pages,
  build_player admin page, Caddy status on HTTPS config page
- Migrations: add_url_to_content, add_deployment_fields_to_player
- app.py: call db.create_all() on startup for schema bootstrap
- config.py: add PLAYER_CODE_DIR and PLAYER_REPO_URL settings

app/utils/portal_sso.py

@@ -0,0 +1,52 @@
+"""
+Portal SSO middleware for DigiServer v2.
+
+When the umbrella nginx verifies the portal JWT it sets two headers:
+  X-Auth-Username  — the portal username
+  X-Auth-Role      — 'admin' or 'user'
+
+This before_request handler reads those headers and auto-logs in the
+corresponding local DigiServer user, creating them on first access if
+needed. The local session is then maintained normally by Flask-Login.
+"""
+import secrets
+from flask import request
+from flask_login import login_user, current_user
+
+
+def init_portal_sso(app):
+    """Register the SSO before_request handler on the given Flask app."""
+
+    @app.before_request
+    def _portal_sso():
+        if current_user.is_authenticated:
+            return
+
+        username = request.headers.get('X-Auth-Username', '').strip()
+        if not username:
+            return
+
+        role = request.headers.get('X-Auth-Role', 'user').strip()
+        user = _get_or_create_user(username, role)
+        if user:
+            login_user(user, remember=False)
+
+
+def _get_or_create_user(username, role):
+    from app.models.user import User
+    from app.extensions import db, bcrypt
+
+    try:
+        user = User.query.filter_by(username=username).first()
+        if not user:
+            hashed_pw = bcrypt.generate_password_hash(secrets.token_hex(32)).decode('utf-8')
+            user = User(
+                username=username,
+                password=hashed_pw,
+                role='admin' if role == 'admin' else 'user',
+            )
+            db.session.add(user)
+            db.session.commit()
+        return user
+    except Exception:
+        return None