chore(abs): name the Audiobookshelf door audiobooks.franksdank.cloud

`abs.` was a three-letter abbreviation of the container; the library it serves is
/mnt/entropy/Audiobooks, and `audiobooks.` says what the door is. Renamed in one
commit on purpose: the pihole seam fails the suite if a Caddyfile vhost has no
addn-hosts record, so any split would leave a red commit, and the `abs` name was
never deployed at the IdP with this fix, so nothing has to keep answering it —
no alias, no redirect, no stale URI.

Moves together: the Caddyfile site block, its matcher (@abs -> @audiobooks), the
LAN record, ABS_EXTRA_BASES in authentik-audiobookshelf-sso.sh (that script
REPLACES the provider's redirect-URI list, so the old origin's callback leaves the
RP when it is next run), the homepage admin tile, the guard spec's GUARDED list and
leak marker, and the three vault pages that name the door. authentik's provider row
follows in the deploy window (external_host + name), which re-derives its
redirect_uris through scripts/authentik-proxy-provider-defaults.sh; the Application
row keeps its own name, "Audiobookshelf Guard" — it names the app, not the vhost.

scripts/authentik-audiobookshelf-sso.sh

@@ -79,8 +79,8 @@
 #                            origin, reached directly, which is also what the phone
 #                            app is configured with)
 #   ABS_EXTRA_BASES         space-separated additional origins, base path included
-#                           (default: https://abs.franksdank.cloud/audiobookshelf —
-#                            the guarded vhost, dankclaw/Caddyfile).
+#                           (default: https://audiobooks.franksdank.cloud/audiobookshelf
+#                            — the guarded vhost, dankclaw/Caddyfile).
 #                            ABS builds its redirect_uri from the ORIGIN of the
 #                            request, so each origin the app is served at needs its
 #                            own registered URI — an unregistered origin is a
@@ -100,7 +100,7 @@ SSO_USER="${ABS_OIDC_USERNAME:-akadmin}"
 MEMBERS="${ABS_OIDC_USERS:-}"
 E2E_ADMIN="${ABS_E2E_ADMIN:-qa-e2e-admin}"
 BASE="${ABS_BASE:-http://192.168.0.235:8000/audiobookshelf}"
-EXTRA_BASES="${ABS_EXTRA_BASES:-https://abs.franksdank.cloud/audiobookshelf}"
+EXTRA_BASES="${ABS_EXTRA_BASES:-https://audiobooks.franksdank.cloud/audiobookshelf}"
 HOST="${AUTHENTIK_HOST:-dankclaw}"
 
 # The claim expression: translate group membership into ABS role names. It is stored

scripts/authentik-proxy-provider-defaults.sh

@@ -10,8 +10,8 @@
 #
 #   * redirect_uris empty -> authentik answers its own page:
 #     "Redirect URI Error — The request fails due to a missing, invalid, or
-#     mismatching redirection URI (redirect_uri)". Measured on abs-proxy
-#     (abs.franksdank.cloud) 2026-11-03.
+#     mismatching redirection URI (redirect_uri)". Measured on the Audiobookshelf
+#     guard provider, 2026-11-03.
 #   * grant_types empty -> the authorize endpoint refuses the outpost's
 #     authorization-code request with a bodiless HTTP 400 (Chromium renders
 #     "This page isn't working / HTTP ERROR 400"). Same provider, one step