caddy+authentik tests: uniform Host-preserving :8016 proxy through embedded outpost

The redirect-to-flow design with an absolute cross-host next= was rejected by
the flow's open-redirect guard at completion ("Request has been denied:
Invalid next URL"), and meta-header routing does not exist in this build
(providers route on the ORIGINAL Host). :8016 now proxies every request whole
to authentik-server:9000 preserving Host; the embedded outpost serves login
in place and forwards authenticated traffic back to :8017. Requires one proxy
provider per guarded host (provisioned live: search/hermes/prometheus/romm/
files + www, flows backfilled). Tests flipped from the meta-header claim to
the upheld contract: Host preserved, no absolute next= redirects.

tests/authentik.bats

@@ -2,14 +2,17 @@
 # Seam: Authentik (SSO / OIDC provider) — the homelab's auth layer.
 #
 # Authentik is a 3-service stack (PostgreSQL + server + worker) on dankclaw.
-# It provides OIDC, SAML, and Caddy forward_auth for the vhosts that do not
-# have their own application-level authentication (SearXNG, Hermes,
-# Prometheus, RomM, Copyparty, the homepage).
+# It protects the vhosts that have no application-level authentication
+# (SearXNG, Hermes, Prometheus, RomM, Copyparty, the homepage) with its
+# embedded proxy outpost.
 #
-# The Caddyfile carries an `auth.franksdank.cloud` vhost that proxies to the
-# Authentik server. Vhosts without their own auth are wrapped in a `route`
-# block that (1) proxies the outpost path to Authentik, (2) runs forward_auth,
-# (3) serves the app.
+# The Caddyfile carries an `auth.franksdank.cloud` vhost for the admin UI, and
+# an internal `:8016` listener that Anubis dials after verifying a client.
+# :8016 proxies every request whole to the Authentik server with the Host
+# header preserved; the embedded outpost routes on the ORIGINAL Host against
+# each proxy provider's external_host (meta headers do NOT route it —
+# disproved live, 2026-08-29) and forwards authenticated traffic back to the
+# post-auth listener `:8017`.
 #
 # See ../docs/Infrastructure/Authentik.md.
 
@@ -101,10 +104,12 @@ UNIT_DIR="$REPO_ROOT/dankclaw/authentik/quadlet"
     awk '/^http:\/\/:8016/,/^\}/' "$CADDYFILE" | grep -q 'reverse_proxy authentik-server:9000'
 }
 
-@test "the auth decision carries the outpost meta headers" {
-    grep -q 'X-authentik-meta-outpost' "$CADDYFILE"
-    grep -q 'X-authentik-meta-provider' "$CADDYFILE"
-    grep -q 'X-authentik-meta-app' "$CADDYFILE"
+@test "the internal listener preserves Host and never emits cross-host next=" {
+    # The outpost routes on the original Host: no header_up Host override...
+    ! grep -q 'header_up Host' "$CADDYFILE"
+    # ...and the rejected design (absolute cross-host next= into the flow UI)
+    # must never return — it produces "Invalid next URL" at flow completion.
+    ! grep -qE 'if/flow/[^ ]*next=https' "$CADDYFILE"
 }
 
 @test "authenticated traffic returns to Caddy on the post-auth listener" {