Authentik SSO + homepage naked domain

Auth layer (Authentik 2026.8.0):
- compose: 3-service stack (authentik-postgres, authentik-server, authentik-worker),
  postgres health-gated, bind mounts under /home/dank/authentik
- Caddyfile: auth.franksdank.cloud vhost; forward_auth on the no-auth vhosts
  (homepage, SearXNG, Hermes, Prometheus, RomM, Copyparty); outpost path
  proxied first in a route block
- .env.example: AUTHENTIK_PG_PASS + AUTHENTIK_SECRET_KEY
- deploy.sh: render only CADDY_BASICAUTH_HASH (the homepage per-user hashes
  are retired; grafana + pihole keep basicauth)
- tests/authentik.bats (new) + updated homepage/caddyfile/pihole seams
- docs: Authentik.md + per-service pages; Caddy.md + Homepage.md updated

Homepage (naked domain):
- Caddyfile: dankclaw.franksdank.cloud -> franksdank.cloud www.franksdank.cloud;
  dankclaw + dankserver redirect to it; bare-IP catch-all updated
- addn-hosts: A records for the naked domain, www, and auth (all -> 143)
- tests/pihole.bats: vhost_names handles multi-address blocks; TLD check
  allows the naked domain

All 146 tests pass.

dankclaw/.env.example

@@ -25,16 +25,14 @@ GRAFANA_ADMIN_USER=admin
 GRAFANA_ADMIN_PASSWORD=changeme
 
 # Caddy (the homelab's single reverse proxy, on this host)
-# bcrypt hashes (caddy hash-password). deploy.sh renders them into
+# bcrypt hash (caddy hash-password). deploy.sh renders it into
 # /home/dank/Containers/caddy/Caddyfile.
-# CADDY_BASICAUTH_HASH: the shared family password (the other vhosts: gitea,
-#   grafana, search, ...). Username: dank.
+# CADDY_BASICAUTH_HASH: the shared family password, still used by the
+#   vhosts that carry basicauth rather than Authentik forward_auth
+#   (grafana, pihole). Username: dankuser.
 CADDY_BASICAUTH_HASH=changeme
-# CADDY_ADMIN_HASH: the operator-only password (the homepage /admin/ page).
-#   Username: frank.
-CADDY_ADMIN_HASH=changeme
-# CADDY_HOMEPAGE_HASH: the homepage user-page password. Username: dankuser.
-CADDY_HOMEPAGE_HASH=changeme
+# (The homepage's per-user hashes were retired: the homepage and its /admin/
+#  page are now behind Authentik forward_auth, not basicauth.)
 
 # Hermes -> Signal (signal-cli daemon on the host, port 8080)
 # E.164 number of the linked Signal account (your primary number, for Note-to-Self).
@@ -48,3 +46,11 @@ SIGNAL_ALLOWED_USERS=+15551234567
 # PORKBUN_API_SECRET_KEY is the name the caddy-dns/porkbun module expects.
 PORKBUN_API_KEY=changeme
 PORKBUN_API_SECRET_KEY=changeme
+
+# Authentik (SSO / OIDC provider)
+# AUTHENTIK_PG_PASS: the PostgreSQL password for authentik-postgres.
+#   Generate: openssl rand -base64 32
+AUTHENTIK_PG_PASS=changeme
+# AUTHENTIK_SECRET_KEY: the server's secret key (64+ chars).
+#   Generate: openssl rand -base64 48
+AUTHENTIK_SECRET_KEY=changeme