Reprovision spore

[stackptr]

Following a Cloudcone incident, spore needs to be setup again. This PR tracks that process which so far consists of key/secrets management.

[stackptr]

I did not record the process to originally provision the Cloudcone VPS with NixOS, but after some trial and error I think it was using nixos-anywhere and not nixos-infect:

cd rc
nix run github:nix-community/nixos-anywhere -- --flake .#spore --target-host root@<ip>

[stackptr]

Pocket ID database was not being backed up, so had to be setup from scratch to restore OAuth flow:

• Created admin user
• Created "Shared SSO" OIDC client using expected client id
• Updated OAuth2-Proxy env to use regenerated client secret
• Created user group, containing admin user, and granted access to Shared SSO