thread_id: 01a10a47-6406-7086-a869-d8f92b6dc5a8
updated_at: 1791185010

Added Authentik user `ridley` (ridley@franksdank.cloud) with user-level-only access via Django ORM in `ak shell` on dankclaw. Key workflow: SSH to dankclaw, run `ak shell`, create User with set_password(), assign groups (Non-Admin Users, jellyfin_users, openwebui_users). Verified auth via authenticate() ORM call. Browser SPA interaction is unreliable for Authentik flows—use ORM verification instead. Group membership is the sole gate for app access in this deployment.