Authentik SSO + homepage naked domain

Auth layer (Authentik 2026.8.0):
- compose: 3-service stack (authentik-postgres, authentik-server, authentik-worker),
  postgres health-gated, bind mounts under /home/dank/authentik
- Caddyfile: auth.franksdank.cloud vhost; forward_auth on the no-auth vhosts
  (homepage, SearXNG, Hermes, Prometheus, RomM, Copyparty); outpost path
  proxied first in a route block
- .env.example: AUTHENTIK_PG_PASS + AUTHENTIK_SECRET_KEY
- deploy.sh: render only CADDY_BASICAUTH_HASH (the homepage per-user hashes
  are retired; grafana + pihole keep basicauth)
- tests/authentik.bats (new) + updated homepage/caddyfile/pihole seams
- docs: Authentik.md + per-service pages; Caddy.md + Homepage.md updated

Homepage (naked domain):
- Caddyfile: dankclaw.franksdank.cloud -> franksdank.cloud www.franksdank.cloud;
  dankclaw + dankserver redirect to it; bare-IP catch-all updated
- addn-hosts: A records for the naked domain, www, and auth (all -> 143)
- tests/pihole.bats: vhost_names handles multi-address blocks; TLD check
  allows the naked domain

All 146 tests pass.

tests/homepage_deploy.bats

@@ -1,17 +1,18 @@
 #!/usr/bin/env bats
 # Seam: scripts/deploy.sh deploys the homepage, and the checker runs as a
 # systemd timer. The deploy is git-driven (master = the deployed state, Q33).
-# The tests assert the deploy references the homepage steps and renders BOTH
-# hashes, and that the checker timer + service exist and point at the checker.
+# The tests assert the deploy references the homepage steps and renders the
+# basicauth hash, and that the checker timer + service exist and point at the
+# checker. (The homepage's per-user hashes were retired: it now uses Authentik
+# forward_auth, so only the shared family hash is rendered.)
 
 load helpers
 
-@test "deploy.sh ships the homepage (assets, timer, both hashes, deployed.js)" {
+@test "deploy.sh ships the homepage (assets, timer, basicauth hash, deployed.js)" {
     local d="$REPO_ROOT/scripts/deploy.sh"
     grep -q "/srv/homepage" "$d"
     grep -q "homepage-status" "$d"
     grep -q "CADDY_BASICAUTH_HASH" "$d"
-    grep -q "CADDY_ADMIN_HASH" "$d"
     grep -q "deployed.js" "$d"
 }