Authentik SSO + homepage naked domain

Auth layer (Authentik 2026.8.0):
- compose: 3-service stack (authentik-postgres, authentik-server, authentik-worker),
  postgres health-gated, bind mounts under /home/dank/authentik
- Caddyfile: auth.franksdank.cloud vhost; forward_auth on the no-auth vhosts
  (homepage, SearXNG, Hermes, Prometheus, RomM, Copyparty); outpost path
  proxied first in a route block
- .env.example: AUTHENTIK_PG_PASS + AUTHENTIK_SECRET_KEY
- deploy.sh: render only CADDY_BASICAUTH_HASH (the homepage per-user hashes
  are retired; grafana + pihole keep basicauth)
- tests/authentik.bats (new) + updated homepage/caddyfile/pihole seams
- docs: Authentik.md + per-service pages; Caddy.md + Homepage.md updated

Homepage (naked domain):
- Caddyfile: dankclaw.franksdank.cloud -> franksdank.cloud www.franksdank.cloud;
  dankclaw + dankserver redirect to it; bare-IP catch-all updated
- addn-hosts: A records for the naked domain, www, and auth (all -> 143)
- tests/pihole.bats: vhost_names handles multi-address blocks; TLD check
  allows the naked domain

All 146 tests pass.

tests/pihole.bats

@@ -87,17 +87,21 @@ HOSTS="$PIHOLE_DIR/addn-hosts"
         case "$line" in \#*) continue ;; esac
         ip="$(echo "$line" | awk '{print $1}')"
         for n in $(echo "$line" | cut -d' ' -f2-); do
-            echo "$n" | grep -qE '\.(franksdank\.(cloud|casa))$' \
+            echo "$n" | grep -qE '(^|\.)franksdank\.(cloud|casa)$' \
                 || { echo "UNEXPECTED TLD on $ip: $n"; bad=1; }
         done
     done < "$HOSTS"
     [ "$bad" -eq 0 ]
 }
 
-# vhost_names <caddyfile> — print site-block names under the flat scheme
+# vhost_names <caddyfile> — print site-block names under the flat scheme.
+# Handles both single-address blocks ("name {") and multi-address blocks
+# ("name1 name2 {"), one name per line.
 vhost_names() {
-    grep -oE '^(http://)?[a-z0-9.-]+\.franksdank\.(cloud|casa)[[:space:]]*\{' "$1" \
-        | sed -E 's#^http://##; s/[[:space:]]*\{$//'
+    grep -E '^(http://)?[a-z0-9.-]+\.franksdank\.(cloud|casa)([[:space:]]+[a-z0-9.-]+\.franksdank\.(cloud|casa))*[[:space:]]*\{' "$1" \
+        | sed -E 's/^[[:space:]]+//; s/[[:space:]]*\{$//' \
+        | tr ' ' '\n' \
+        | sed -E 's#^http://##'
 }
 
 # record_ip_for <name> — print the IP a name maps to in addn-hosts