Convert the remaining Serveex and recycled articles to steps

content/en/3.serveex/3.security/3.pocket-id.md

@@ -8,6 +8,8 @@ description: Install Pocket ID, a lightweight self-hosted OIDC provider that let
 
 [Pocket ID](https://pocket-id.org) is a minimalist, self-hosted OIDC (OpenID Connect) provider built entirely around passkeys: instead of managing passwords, you and your users log in to compatible apps with a **passkey** (fingerprint, face unlock, or a hardware security key). It runs as a single lightweight container with no external database to manage, and it does exactly one thing well: issuing OIDC logins.
 
+![pocketid](/img/serveex/pocketid.png)
+
 This makes it a good fit if you just need a simple, fast SSO backend, for example to pair with [TinyAuth](/serveex/security/tinyauth) as a lightweight forward-auth setup, or to log in directly to apps that natively support OIDC.
 
 - [Pocket ID documentation](https://pocket-id.org/docs)

content/en/3.serveex/3.security/4.tinyauth.md

@@ -8,6 +8,8 @@ description: Install TinyAuth, a lightweight forward-auth proxy, and pair it wit
 
 [TinyAuth](https://tinyauth.app) is a small forward-auth proxy: a single login page that Swag can insert in front of any app before letting a request through, checking whether a visitor is authenticated before forwarding them on.
 
+![tinyauth](/img/serveex/tinyauth.png)
+
 It supports a simple local username/password login out of the box, and can also delegate login to an external OIDC provider. Here we'll use [Pocket ID](/serveex/security/pocket-id), so anyone visiting a protected app first authenticates with a passkey via Pocket ID, then gets forwarded through.
 
 - [TinyAuth documentation](https://tinyauth.app/docs)