Document DoneTick Pangolin and Authentik config

docs/troubleshooting/KNOWN_QUIRKS.md

@@ -25,6 +25,8 @@ Per-service gotchas that aren't bugs but will bite you if you forget them.
 - Env vars alone are insufficient for DB type selection
 - Requires `/mnt/tank/docker/appdata/donetick/config/selfhosted.yaml` with full DB config
 - Uses viper config loader — `DT_ENV` controls config file path
+- Public exposure through Pangolin can stay unhealthy after renumbering if the target health-check hostname is stale even when the target IP/port are already fixed; verify both `ip` and `hcHostname`
+- OIDC metadata for the frontend is exposed from `/api/v1/resource`; if the login button is missing, check that endpoint before debugging the SPA
 
 ### shlink
 - Data directory must be `chmod 777` — runs as non-root user that doesn't match host default ownership