update: 2025.6.4 -> 2025.8.1

See https://next.goauthentik.io/releases/2025.8/
ChangeLog: https://next.goauthentik.io/releases/2025.8/#fixed-in-202581

The following things changed:

* We're blocked on going to NodeJS 24.x (which is the version upstream
  uses) because it breaks with napalm[1].

* The worker has been switched from celery to dramatiq. An automatic
  migration of the tasks doesn't exist, the operator must make sure to
  stop the server and let the queue drain[2].

  While this eliminates the need of Redis for Celery, the tests fails
  without Redis. After inspecting the code, it looks like it's still
  needed for e.g. session management.

[1] https://github.com/npm/cli/issues/8541
[2] https://next.goauthentik.io/releases/2025.8/#fixed-in-202581

components/docs.nix

@@ -13,8 +13,10 @@ buildNapalmPackage "${authentik-src}/website" {
     "cp -v ${authentik-src}/SECURITY.md ../SECURITY.md"
     "cp -vr ${authentik-src}/blueprints ../blueprints"
     "cp -v ${authentik-src}/schema.yml ../schema.yml"
-    "npm install --include=dev"
-    "npm run build-bundled"
+    "cp -v ${authentik-src}/docker-compose.yml ../docker-compose.yml"
+    "npm config set loglevel verbose"
+    "npm ci --workspaces --include-workspace-root --no-audit"
+    "npm run build"
   ];
   installPhase = ''
     rm -f ../website/static/blueprints

components/frontend.nix

@@ -17,8 +17,9 @@ buildNapalmPackage "${authentik-src}/web" rec {
   # from release build dependencies, therefore this workaround
   CHROMEDRIVER_SKIP_DOWNLOAD = "true";
   npmCommands = [
-    "npm install --include=dev --nodedir=${nodejs}/include/node --loglevel verbose"
+    "npm install --include=dev --nodedir=${nodejs}/include/node --loglevel verbose --ignore-scripts"
     "npm run build"
+    "npm run build:sfe"
   ];
   installPhase = ''
     mkdir $out

components/gopkgs.nix

@@ -42,7 +42,7 @@ buildGo124Module {
     "cmd/proxy"
     "cmd/radius"
   ];
-  vendorHash = "sha256-7oX7e7Ni5I6zblEQIeXjYOt4+QNSjH4Rpn7B5Cr5LMc=";
+  vendorHash = "sha256-wTTEDBRYCW1UFaeX49ufLT0c17sacJzcCaW/8cPNYR4=";
   nativeBuildInputs = [ makeWrapper ];
   doCheck = false;
   postInstall = ''