pkgs.calino: 0.39.1 -> 0.40.0

When VictoriaMetrics has no sample shortly before the increase() window
(the monitoring server was down, or the series is new), MetricsQL's
increase() treats the first sample in the window as an increase from 0 and
returns the whole counter. After styx lost power for ~9 minutes, OOMKill
fired for coaxmetal with all 5 OOM kills since its boot 49 days ago,
although the counter never moved.

Only alert when the series has a sample in the minute before the window
(two minutes for the 60s smartctl scrape). Then increase() has a real
previous value, and still handles counter resets on a monitored host's
reboot. increase_pure() does not help: it assumes counters start at 0
and so counts the whole value as well.

NvmeMediaErrors uses increase() on a counter the same way and would
fire for any drive with past media errors after a gap, so it gets the
same guard. MemoryPressure's rate() is not affected: rate() does not
count the first sample in the window as an increase.

Mounts an empty auth_providers list to /config/auth_providers.yaml. homeassistant: auth_providers is read only from configuration.yaml, packages can't set it, so the volume's configuration.yaml includes it once (auth_providers: !include auth_providers.yaml under homeassistant:). Without the homeassistant provider only auth_oidc remains: the welcome page redirects straight to id.lassul.us and no password form is offered.

Long-lived access tokens have no credential and are not checked against a provider, so they keep working. Refresh tokens from earlier password logins fail on the next refresh and need one id.lassul.us login. The password credentials stay in the auth store, so a revert brings the password login back.

Zitadel project hass on neoprism with a public app (PKCE, no secret) and access = "managed": users get access via a user grant an admin gives in the id.lassul.us console. On acheron the auth_oidc custom component from nixpkgs is mounted into the Home Assistant container and configured via /config/packages, next to the username/password login.

modules.zitadel gets authMethod = "none" for public clients: reconcile generates no secret for them and writes only the client id to the env file, so nothing secret has to reach acheron.

Zitadel generates the client id, so it cannot be known at eval time on acheron. It is not secret; after neoprism is deployed it is copied from /var/lib/zitadel-apps/hass-web.env into the prompted hass-oidc var and passed to the container as HASS_OIDC_CLIENT_ID (!env_var in the yaml).

automatic_user_linking reuses the existing HA user whose username equals the preferred_username claim instead of creating a new one; it stays on because only users granted the project can log in. The groups scope is not requested since Zitadel has no groups claim.

Keeps Login V1 (also for a new instance) and turns off the service ping
that v4 sends to zitadel.com by default.