Verifying the Marreta auth chain:
1. Probe `http://localhost:8017/` from host (expected 000, listener is in Caddy netns).
2. Check `authentik-proxy-provider-app-link` for null flows.
3. Ensure non-browser clients can bypass JS challenges or use backend datasource URLs.