anubis: bot-challenge proxy in front of the guarded vhosts (two-tier chain)

Bots and AI scrapers hit the SSO-fronted vhosts and eat Authentik auth
work for 403s. Anubis verifies clients first: DENY for known AI scraper
UAs, JS challenge for everyone else; verified traffic resumes the normal
Authentik forward_auth chain on Caddy's internal listener (:8016).

Chain: client -> Caddy (TLS) -> Anubis :8923 (verify) -> Caddy :8016
(auth + routing resumes; Host survives both hops) -> app. Reverse-proxy
through Anubis, not forward_auth: at the pinned tag a CHALLENGE answers
HTTP 200 + HTML, and forward_auth treats 200 as "authenticated" — the
page would pass through unchallenged. Exempt by construction (never
routed through Anubis): plex (plain HTTP legacy), auth.* (IdP login
must be reachable ungated), gitea (git smart-HTTP clients cannot solve
JS challenges), and every app with its own login.

Pinned ghcr.io/TecharoHQ/anubis:v1.13.0 — the tag was source-verified
before pinning: at this tag the policy parser is JSON-only with a
minimal bots[] schema (no imports, no CEL expressions), flags are the
config surface via flagenv (TARGET/POLICY_FNAME map to --target/
--policy-fname), and the image's exec-form HEALTHCHECK is inherited by
the quadlet unit (dodges the v1 generator's HealthCmd space-split quirk).

Rollback nuance: stopping anubis 502s everything behind the chain (the
public listeners proxy through it); a true rollback is reverting the
Caddyfile and redeploying, not just systemctl --user stop anubis.

scripts/test-changed.sh

@@ -120,6 +120,17 @@ for path in "${CHANGED[@]}"; do
             add_test tests/searxng_quadlet.bats
             add_test tests/deployment_scoping.bats
             ;;
+        # Anubis is a quadlet + Caddyfile pair: the chain (public listener ->
+        # anubis:8923 -> internal :8016 listener) spans both, so any change
+        # under the service dir must re-run the caddyfile seam too. This case
+        # precedes the dankclaw/*/quadlet/*.container fallback below, which
+        # would otherwise swallow it into unrelated seams.
+        dankclaw/anubis/*)
+            add_test tests/anubis.bats
+            add_test tests/caddyfile.bats
+            add_test tests/homepage_caddy.bats
+            add_test tests/deployment_scoping.bats
+            ;;
         # Quadlets live under dankclaw/<svc>/quadlet/ (reorganized out of the
         # top-level dankclaw/*.container globs above). Map the whole subtree so
         # changes to the pihole, open-webui, searxng, and gitea quadlets hit