Authentik SSO + homepage naked domain

Auth layer (Authentik 2026.8.0):
- compose: 3-service stack (authentik-postgres, authentik-server, authentik-worker),
  postgres health-gated, bind mounts under /home/dank/authentik
- Caddyfile: auth.franksdank.cloud vhost; forward_auth on the no-auth vhosts
  (homepage, SearXNG, Hermes, Prometheus, RomM, Copyparty); outpost path
  proxied first in a route block
- .env.example: AUTHENTIK_PG_PASS + AUTHENTIK_SECRET_KEY
- deploy.sh: render only CADDY_BASICAUTH_HASH (the homepage per-user hashes
  are retired; grafana + pihole keep basicauth)
- tests/authentik.bats (new) + updated homepage/caddyfile/pihole seams
- docs: Authentik.md + per-service pages; Caddy.md + Homepage.md updated

Homepage (naked domain):
- Caddyfile: dankclaw.franksdank.cloud -> franksdank.cloud www.franksdank.cloud;
  dankclaw + dankserver redirect to it; bare-IP catch-all updated
- addn-hosts: A records for the naked domain, www, and auth (all -> 143)
- tests/pihole.bats: vhost_names handles multi-address blocks; TLD check
  allows the naked domain

All 146 tests pass.

tests/homepage_caddy.bats

@@ -1,8 +1,9 @@
 #!/usr/bin/env bats
-# Seam: the homepage site block in dankclaw/Caddyfile. It must carry a root
-# basicauth hash and a distinct /admin/-scoped admin hash (Q18/Q19), and serve
-# /srv/homepage. caddy is not on the dev box, so the tests assert the
-# structure statically; the deploy renders the two real hashes from the .env.
+# Seam: the homepage site block in dankclaw/Caddyfile. It serves /srv/homepage
+# from the naked domain (franksdank.cloud) and www. Authentication is via
+# Caddy forward_auth (Authentik SSO) — the basicauth hashes were retired in
+# favor of the unified Authentik login. caddy is not on the dev box, so the
+# tests assert the structure statically.
 
 load helpers
 
@@ -10,38 +11,28 @@ setup() {
     CADDY="$REPO_ROOT/dankclaw/Caddyfile"
 }
 
-@test "the homepage has its own hash and a distinct admin hash" {
-    grep -q "REPLACE_WITH_HOMEPAGE_HASH" "$CADDY"
-    grep -q "REPLACE_WITH_ADMIN_HASH" "$CADDY"
-}
-
-@test "the admin basicauth is scoped to /admin/ (Q19)" {
-    # The admin page is a 'handle /admin*' block with the operator (frank)
-    # credential. Caddy sorts a top-level 'rewrite' before 'basicauth', which
-    # would change the path and break the path-based auth matcher; 'handle'
-    # preserves order, so the auth is checked on the original path.
-    grep -qE "handle[[:space:]]+/admin\*" "$CADDY"
-    grep -qE "frank[[:space:]]+REPLACE_WITH_ADMIN_HASH" "$CADDY"
-}
-
 @test "the homepage serves /srv/homepage" {
     grep -q "root \* /srv/homepage" "$CADDY"
     grep -q "file_server" "$CADDY"
 }
 
 @test "the /admin/ page serves admin.html and / serves index.html" {
-    # Each page is served by its own 'handle' block via 'try_files' (which
-    # serves the named file without a top-level 'rewrite' that Caddy would
-    # sort before the basicauth).
+    # Each page is served by its own 'handle' block via 'try_files'.
+    grep -qE "handle[[:space:]]+/admin\*" "$CADDY"
     grep -qE "try_files[[:space:]]+/admin.html" "$CADDY"
     grep -qE "try_files[[:space:]]+/index.html" "$CADDY"
 }
 
-@test "the shared data + assets accept both the family and the operator" {
-    # The admin page (frank) and the user page (dank) both fetch the shared
-    # data (services.json, status.json) and assets. The browser reuses the
-    # page's credential for these, so the block must accept both users.
+@test "the shared data + assets are served to any authenticated user" {
+    # The data (services.json, status.json) and assets are fetched by both the
+    # user page and the admin page. With forward_auth, any authenticated user
+    # can access them (the browser's Authentik session covers the fetch).
     grep -qE "@data[[:space:]]+path[[:space:]]+/services\.json[[:space:]]+/status\.json" "$CADDY"
     grep -qE "handle[[:space:]]+@data" "$CADDY"
-    grep -qE "dankuser[[:space:]]+REPLACE_WITH_HOMEPAGE_HASH" "$CADDY"
+}
+
+@test "the homepage vhost uses forward_auth (Authentik SSO)" {
+    local block
+    block=$(awk '/^franksdank\.cloud[[:space:]]/,/^}/' "$CADDY")
+    echo "$block" | grep -q 'forward_auth'
 }