So if I want to host a number of different services (Tandoor, Discourse, Lemmy, GtS) and offer #SelfHosted #SSO, so that I can create a single account for each user and enable or disable specific sites/apps for them, what are my options for that?

No information that could screw with anyone's life will ever be on these sites so I'm not looking for, you know, NSA-busting cryptography or anything. Just a single go-to spot for user management.