anubis: bot-challenge proxy in front of the guarded vhosts (two-tier chain)

Bots and AI scrapers hit the SSO-fronted vhosts and eat Authentik auth
work for 403s. Anubis verifies clients first: DENY for known AI scraper
UAs, JS challenge for everyone else; verified traffic resumes the normal
Authentik forward_auth chain on Caddy's internal listener (:8016).

Chain: client -> Caddy (TLS) -> Anubis :8923 (verify) -> Caddy :8016
(auth + routing resumes; Host survives both hops) -> app. Reverse-proxy
through Anubis, not forward_auth: at the pinned tag a CHALLENGE answers
HTTP 200 + HTML, and forward_auth treats 200 as "authenticated" — the
page would pass through unchallenged. Exempt by construction (never
routed through Anubis): plex (plain HTTP legacy), auth.* (IdP login
must be reachable ungated), gitea (git smart-HTTP clients cannot solve
JS challenges), and every app with its own login.

Pinned ghcr.io/TecharoHQ/anubis:v1.13.0 — the tag was source-verified
before pinning: at this tag the policy parser is JSON-only with a
minimal bots[] schema (no imports, no CEL expressions), flags are the
config surface via flagenv (TARGET/POLICY_FNAME map to --target/
--policy-fname), and the image's exec-form HEALTHCHECK is inherited by
the quadlet unit (dodges the v1 generator's HealthCmd space-split quirk).

Rollback nuance: stopping anubis 502s everything behind the chain (the
public listeners proxy through it); a true rollback is reverting the
Caddyfile and redeploying, not just systemctl --user stop anubis.

scripts/deploy-remote.sh

@@ -550,6 +550,22 @@ deploy_authentik() {
     systemctl --user start authentik-worker.service
 }
 
+deploy_anubis() {
+    # Anubis is the bot-challenge proxy in front of the guarded vhosts.
+    # The image lives on ghcr.io; pull once, then the unit runs it from
+    # local storage (Pull=never keeps boots off the registry).
+    if ! podman image inspect ghcr.io/TecharoHQ/anubis:v1.13.0 >/dev/null 2>&1; then
+        podman pull ghcr.io/TecharoHQ/anubis:v1.13.0
+    fi
+    cp "dankclaw/anubis/quadlet/anubis.container" "$quadlet_unit_dir/"
+    systemctl --user daemon-reload
+    # No enable: generated units cannot be enabled on this host (v1 quadlet
+    # generator); boot persistence comes from [Install] in the unit file.
+    # restart, not start: policy.json is parsed at process start only (no
+    # reload signal exists), so every redeploy must cycle the process.
+    systemctl --user restart anubis.service
+    wait_container_healthy anubis 60 || return 1
+}
 
 deploy_llm_large() {
     relink_unit frank-default-large
@@ -604,6 +620,7 @@ deploy_service() {
         authentik-postgres|authentik-server|authentik-worker)
             deploy_authentik
             ;;
+        anubis) deploy_anubis ;;
         frank-default-large) deploy_llm_large ;;
         frank-default-small) deploy_llm_small ;;
         frank-default-npu) deploy_llm_npu ;;