Evaluate options for replacing LLDAP+Authelia with a unified auth solution. Recommends Kanidm for its native NixOS PAM/NSS integration and built-in OIDC. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>