chore(abs): name the Audiobookshelf door audiobooks.franksdank.cloud

`abs.` was a three-letter abbreviation of the container; the library it serves is
/mnt/entropy/Audiobooks, and `audiobooks.` says what the door is. Renamed in one
commit on purpose: the pihole seam fails the suite if a Caddyfile vhost has no
addn-hosts record, so any split would leave a red commit, and the `abs` name was
never deployed at the IdP with this fix, so nothing has to keep answering it —
no alias, no redirect, no stale URI.

Moves together: the Caddyfile site block, its matcher (@abs -> @audiobooks), the
LAN record, ABS_EXTRA_BASES in authentik-audiobookshelf-sso.sh (that script
REPLACES the provider's redirect-URI list, so the old origin's callback leaves the
RP when it is next run), the homepage admin tile, the guard spec's GUARDED list and
leak marker, and the three vault pages that name the door. authentik's provider row
follows in the deploy window (external_host + name), which re-derives its
redirect_uris through scripts/authentik-proxy-provider-defaults.sh; the Application
row keeps its own name, "Audiobookshelf Guard" — it names the app, not the vhost.

dankclaw/Caddyfile

@@ -268,10 +268,11 @@ files.franksdank.cloud {
 # Anubis → Authentik → app, like romm/files. The container carries
 # ROUTER_BASE_PATH=/audiobookshelf, so this vhost serves the app under that
 # path; the bare root is redirected onto it in the post-auth listener, never
-# pre-auth. Guard state in the IdP: proxy provider `abs-proxy`
-# (external_host https://abs.franksdank.cloud/, internal_host http://caddy:8017,
-# application "Audiobookshelf Guard"), claimed by the embedded outpost.
-abs.franksdank.cloud {
+# pre-auth. Guard state in the IdP: proxy provider `audiobooks-proxy`
+# (external_host https://audiobooks.franksdank.cloud/, internal_host
+# http://caddy:8017, application "Audiobookshelf Guard"), claimed by the
+# embedded outpost.
+audiobooks.franksdank.cloud {
 	reverse_proxy anubis:8923 {
 		header_up X-Real-Ip {remote_host}
 	}
@@ -423,8 +424,8 @@ http://:8017 {
 		reverse_proxy 192.168.0.235:3923
 	}
 
-	@abs host abs.franksdank.cloud
-	handle @abs {
+	@audiobooks host audiobooks.franksdank.cloud
+	handle @audiobooks {
 		# The app answers only under its ROUTER_BASE_PATH; the bare root is a
 		# convenience hop, taken post-auth so nothing reaches the app
 		# pre-authentication.

dankclaw/pihole/addn-hosts

@@ -26,7 +26,7 @@
 192.168.0.143 romm.franksdank.cloud
 192.168.0.143 files.franksdank.cloud
 192.168.0.143 jelly.franksdank.cloud
-192.168.0.143 abs.franksdank.cloud
+192.168.0.143 audiobooks.franksdank.cloud
 192.168.0.143 radarr.franksdank.cloud
 192.168.0.143 lidarr.franksdank.cloud
 192.168.0.143 readarr.franksdank.cloud