Bump pinned images to latest: authentik 2026.8.3, tautulli ls245, calibre-web ls402, plex 1.43.4

- authentik 2026.8.0 -> 2026.8.3 (server, worker, outpost quadlets)
- tautulli v2.18.1-ls242 -> v2.18.1-ls245
- calibre-web 0.6.27-ls397 -> 0.6.27-ls402
- plex 1.43.3.10896-ls322 -> 1.43.4.10903-ls325
- seerr already at v3.4.1 (latest, no bump)
- sync docs + the dead compose.yaml plex entry

anubis is already at the latest stable (v1.27.0); only pre-releases exist
beyond it, so no stable bump. Local-build images (caddy, alloy, loki,
comfyui, hermes) are refreshed by forced --no-cache rebuilds, not pins.

serverAppConfigs-docs/Infrastructure/Authentik.md

@@ -15,7 +15,7 @@ application-level authentication with its embedded proxy outpost. Apps that
 have their own login (Grafana, Gitea, OpenWebUI, Jellyfin, the *arr stack,
 Pi-hole) are not wrapped — they handle their own session.
 
-- **Version:** `2026.8.0` (pinned in `dankclaw/authentik/quadlet/*.container`)
+- **Version:** `2026.8.3` (pinned in `dankclaw/authentik/quadlet/*.container`)
 - **Host:** dankclaw (`192.168.0.143`)
 - **Name:** `auth.franksdank.cloud`
 - **Stack:** 3 compose services — `authentik-postgres`, `authentik-server`,
@@ -70,8 +70,8 @@ contract:
 | Service | Role | Image |
 |---|---|---|
 | `authentik-postgres` | PostgreSQL 16 (users, flows, sessions, events) | `docker.io/library/postgres:16-alpine` |
-| `authentik-server` | Core + admin API + the embedded Caddy outpost (port 9000) | `ghcr.io/goauthentik/server:2026.8.0` |
-| `authentik-worker` | Background tasks (event processing, provider sync, flows) | `ghcr.io/goauthentik/server:2026.8.0` |
+| `authentik-server` | Core + admin API + the embedded Caddy outpost (port 9000) | `ghcr.io/goauthentik/server:2026.8.3` |
+| `authentik-worker` | Background tasks (event processing, provider sync, flows) | `ghcr.io/goauthentik/server:2026.8.3` |
 
 - **Postgres** is the only stateful store. Sessions, caching, and WebSockets
   moved to PostgreSQL in 2025.10 (Redis removed).

serverAppConfigs-docs/Infrastructure/authentik-server.md

@@ -15,7 +15,7 @@ This is the service the Caddy `forward_auth` vhosts proxy to
 `https://auth.franksdank.cloud`.
 
 - **Unit:** `dankclaw/authentik/quadlet/authentik-server.container` (`authentik-server.service`)
-- **Image:** `ghcr.io/goauthentik/server:2026.8.0` (command: `server`)
+- **Image:** `ghcr.io/goauthentik/server:2026.8.3` (command: `server`)
 - **Port:** `9000` (published; the outpost + admin + login all live here)
 - **Data:** `/home/dank/authentik/data` (bind mount, shared with the worker)
 - **Health:** `http://localhost:9000/-/health/`

serverAppConfigs-docs/Infrastructure/authentik-worker.md

@@ -14,7 +14,7 @@ synchronization, scheduled flows, and certificate renewal. It runs the same
 image as the server; the `command: worker` selects the role.
 
 - **Unit:** `dankclaw/authentik/quadlet/authentik-worker.container` (`authentik-worker.service`)
-- **Image:** `ghcr.io/goauthentik/server:2026.8.0` (command: `worker`)
+- **Image:** `ghcr.io/goauthentik/server:2026.8.3` (command: `worker`)
 - **Runs as:** `0:0` (rootless: container root maps to the host user that owns the data dir)
 - **Data:** `/home/dank/authentik/data` (bind mount, shared with the server)
 - **No port** — the worker has no HTTP endpoint.