agent: repoint FLM-NPU model roles off the retired provider; sync memory/skills

config.yml: vision -> llamacpp (dankclaw)/frank-large:auto,
tiny -> llamacpp (dankserver)/frank-small:off,
task -> llamacpp (dankclaw)/frank-large:medium (was flm dankclaw-npu),
matching the flm (dankclaw-npu) provider removal in models.yml.

Memories/managed skills: rollouts and learned notes from the frank-large
KV-pool + sampler work and the noctalia recolor; merged the duplicate
noctalia-palette-recolor skill into noctalia-custom-palette-recolor (adds
the dotfiles-tracking step and the +show-config delta gotcha) and dropped
the superseded legacy memory skills whose ghostty USR1 reload recipe is
wrong for this fleet.

agent/memories/--home-blank-Projects-serverAppConfig--/skills/marreta_authentik/SKILL.md

@@ -0,0 +1,12 @@
+# Marreta & Authentik Deployment
+Podman compose on dankclaw. Shares gluetun egress with searxng.
+## Guard Chain
+Caddy TLS → Anubis (:8923) → Authentik outpost → internal :8017 → marreta
+## Auth Fix & Pitfalls
+- Login-wall caused by null `ProxyProvider.application` & flows crashing Rust outpost.
+- Fix: Link `Application(slug=marreta)`, populate auth/authz/invalidation flows.
+- Probe: `localhost:8017` returns HTTP 000 (Caddy netns). Use internal probe or grep config.
+- Non-browser clients fail JS challenges. Audit service-to-service URLs for public guarded hostnames.
+- Exempt: IdP, Gitea (git smart-HTTP), self-auth services.
+## Verification
+- E2E: `tests/e2e/specs/16-marreta.spec.ts` asserts homepage tile passes guard chain.

agent/memories/--home-blank-Projects-serverAppConfig--/skills/marreta_authentik/examples/e2e_test.md

@@ -0,0 +1,2 @@
+Run: npx playwright test tests/e2e/specs/16-marreta.spec.ts
+Assert: Homepage tile passes Anubis/ProxyProvider guard chain without login-wall parking.

agent/memories/--home-blank-Projects-serverAppConfig--/skills/marreta_authentik/scripts/probe_marreta.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# Health check through netns
+podman exec marreta_caddy wget -qO- http://localhost:8017/ || echo "HTTP 000 expected"
+# Grep config for route flip
+cat /etc/caddy/config.json | grep "reverse_proxy"

agent/memories/--home-blank-Projects-serverAppConfig--/skills/marreta_authentik/templates/authentik-provider.yaml

@@ -0,0 +1,8 @@
+application:
+  name: Marreta
+  slug: marreta
+  provider: marreta-proxy
+flows:
+  authentication: enabled
+  authorization: enabled
+  invalidation: enabled