Bump pinned images to latest: authentik 2026.8.3, tautulli ls245, calibre-web ls402, plex 1.43.4

- authentik 2026.8.0 -> 2026.8.3 (server, worker, outpost quadlets)
- tautulli v2.18.1-ls242 -> v2.18.1-ls245
- calibre-web 0.6.27-ls397 -> 0.6.27-ls402
- plex 1.43.3.10896-ls322 -> 1.43.4.10903-ls325
- seerr already at v3.4.1 (latest, no bump)
- sync docs + the dead compose.yaml plex entry

anubis is already at the latest stable (v1.27.0); only pre-releases exist
beyond it, so no stable bump. Local-build images (caddy, alloy, loki,
comfyui, hermes) are refreshed by forced --no-cache rebuilds, not pins.

serverAppConfigs-docs/Infrastructure/Authentik.md

@@ -15,7 +15,7 @@ application-level authentication with its embedded proxy outpost. Apps that
 have their own login (Grafana, Gitea, OpenWebUI, Jellyfin, the *arr stack,
 Pi-hole) are not wrapped — they handle their own session.
 
-- **Version:** `2026.8.0` (pinned in `dankclaw/authentik/quadlet/*.container`)
+- **Version:** `2026.8.3` (pinned in `dankclaw/authentik/quadlet/*.container`)
 - **Host:** dankclaw (`192.168.0.143`)
 - **Name:** `auth.franksdank.cloud`
 - **Stack:** 3 compose services — `authentik-postgres`, `authentik-server`,
@@ -70,8 +70,8 @@ contract:
 | Service | Role | Image |
 |---|---|---|
 | `authentik-postgres` | PostgreSQL 16 (users, flows, sessions, events) | `docker.io/library/postgres:16-alpine` |
-| `authentik-server` | Core + admin API + the embedded Caddy outpost (port 9000) | `ghcr.io/goauthentik/server:2026.8.0` |
-| `authentik-worker` | Background tasks (event processing, provider sync, flows) | `ghcr.io/goauthentik/server:2026.8.0` |
+| `authentik-server` | Core + admin API + the embedded Caddy outpost (port 9000) | `ghcr.io/goauthentik/server:2026.8.3` |
+| `authentik-worker` | Background tasks (event processing, provider sync, flows) | `ghcr.io/goauthentik/server:2026.8.3` |
 
 - **Postgres** is the only stateful store. Sessions, caching, and WebSockets
   moved to PostgreSQL in 2025.10 (Redis removed).