agent: repoint FLM-NPU model roles off the retired provider; sync memory/skills

config.yml: vision -> llamacpp (dankclaw)/frank-large:auto,
tiny -> llamacpp (dankserver)/frank-small:off,
task -> llamacpp (dankclaw)/frank-large:medium (was flm dankclaw-npu),
matching the flm (dankclaw-npu) provider removal in models.yml.

Memories/managed skills: rollouts and learned notes from the frank-large
KV-pool + sampler work and the noctalia recolor; merged the duplicate
noctalia-palette-recolor skill into noctalia-custom-palette-recolor (adds
the dotfiles-tracking step and the +show-config delta gotcha) and dropped
the superseded legacy memory skills whose ghostty USR1 reload recipe is
wrong for this fleet.

agent/memories/--home-blank-Projects-serverAppConfig--/skills/marreta_authentik/SKILL.md

@@ -0,0 +1,12 @@
+# Marreta & Authentik Deployment
+Podman compose on dankclaw. Shares gluetun egress with searxng.
+## Guard Chain
+Caddy TLS → Anubis (:8923) → Authentik outpost → internal :8017 → marreta
+## Auth Fix & Pitfalls
+- Login-wall caused by null `ProxyProvider.application` & flows crashing Rust outpost.
+- Fix: Link `Application(slug=marreta)`, populate auth/authz/invalidation flows.
+- Probe: `localhost:8017` returns HTTP 000 (Caddy netns). Use internal probe or grep config.
+- Non-browser clients fail JS challenges. Audit service-to-service URLs for public guarded hostnames.
+- Exempt: IdP, Gitea (git smart-HTTP), self-auth services.
+## Verification
+- E2E: `tests/e2e/specs/16-marreta.spec.ts` asserts homepage tile passes guard chain.