Authentik acts as the OIDC provider for Immich, delegating actual authentication to Google (accounts pre-created and matched by email, no open self-registration). Secrets and local data live in .env/data/ (gitignored), configured live via the Authentik API rather than static config files.