docs/sso.md: the sign-in setup ipodderx.sdf1.net really runs

Authentik is Cloudflare Access's OpenID Connect identity provider, not
something in the request path, and the tunnel's requests reach ipx from
the content_default gateway, 192.168.16.1, not 127.0.0.1. The page is
rewritten from what was measured, with checks for both the trusted and
the refused path, and docs/history.md records every change made to get
there with how to undo it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TAC7sLVqfKmY6rsTLXzNgk

CHANGELOG.md

@@ -28,6 +28,9 @@ The long form, with what was wrong before and how it was found, is in
 
 - Show notes that the podcast's host cut off in the middle of a tag no longer open with a scrap of
   HTML: the item's other copy of its notes is shown instead. Daily Meditation Podcast had 57.
+- The sign-in guide, `docs/sso.md`, describes the setup ipodderx.sdf1.net really runs: Authentik as
+  Cloudflare Access's identity provider, and how to find the address ipx has to trust. It had never
+  been checked against a real setup, and pointed at the wrong address.
 
 ## [0.5.1] - 2026-09-12