feat(homepage): Jellyfin live, Audiobookshelf to the household page, Marreta says what it is

Jellyfin's card still read "Work in progress: not open to family users yet"
with no link; the server answers 12.4.0 on :8096 and carries a second
(non-admin) account, so the card flips to live status with its Open link on
http://jelly.franksdank.cloud. It has no Authentik link, and the copy says so.

Audiobookshelf moves category admin -> user. A card renders on exactly one
page, so it leaves /admin: Authentik SSO made it a household app, and the
household page is the door that matters.

Marreta's description now names what it is - the content-cleaning proxy in the
Gluetun netns with a headless companion - and its honest limit.

Also in this change:
- docs.html: a "Media & files" line for the audiobook door and its SSO, plus
  the pre-existing unclosed <ul> under frank-dragoon, which made the whole
  frank-archon block parse inside the dragoon bullet.
- Caddyfile: the jelly. vhost gains the exemption reason the External Exposure
  Policy requires (comment only - Caddy strips comments, so no proxy bounce).
- Homepage.md: classification list gains Audiobookshelf, and the section now
  states that services.json is the authority for placement/WIP/link.

dankclaw/Caddyfile

@@ -290,7 +290,14 @@ audiobooks.franksdank.cloud {
 	}
 }
 
-# --- Jellyfin ---
+# --- Jellyfin (exempt by construction: own auth) --------------------------
+# No Anubis, no outpost: Jellyfin carries its own complete login (its own
+# account store, no Authentik link), which is the policy's exempt category —
+# the same family as plex/ABS/*arr around it. Accepted exposure: the sign-in
+# form is internet-visible with no rate limiter on either side (this Caddy
+# build ships no rate_limit module), so accounts need long unique passwords.
+# The homepage card opened it to the household on 2026-11-03; accounts are
+# created in Jellyfin's own admin UI, not by SSO.
 jelly.franksdank.cloud {
 	reverse_proxy 192.168.0.235:8096
 }

serverAppConfigs-docs/Infrastructure/Homepage.md

@@ -316,7 +316,7 @@ flowchart TD
 **User services** (root page), in section order:
 - **AI** — OpenWebUI, and the three LLM fleet cards (frank-dragoon, frank-archon, frank-zealot — status + docs link, no Open link).
 - **Web Apps** — SearXNG, Gitea, Copyparty, Marreta.
-- **Media Library Apps** — Calibre-Web, RomM, Plex, Jellyfin, Seerr.
+- **Media Library Apps** — Calibre-Web, RomM, Plex, Jellyfin, Seerr, Audiobookshelf (moved up from the admin page 2026-11-03, once Authentik SSO made it a household app).
 
 **Admin services** (`/admin/`), in section order:
 - **Media Library Apps** — the *arr stack (Prowlarr, Sonarr, Radarr, Lidarr, Readarr), qBittorrent, and Tautulli — live on FrankBook-Pro and Dankserver, operator-only: no vhosts (Tautulli included), direct IP:port access only. See [[FrankBook-Pro]].
@@ -324,6 +324,12 @@ flowchart TD
 - **AI** — Hermes, ComfyUI.
 - **Infrastructure** — Caddy, dnsmasq, Gluetun, and the low-level backends (mariadb, valkey, Postgres). The backends show status only. They get a link only where a UI is meaningful.
 
+**The registry is the authority.** `shared/homepage/services.json` decides which
+page a card renders on (`category`), whether it shows a WIP badge instead of live
+status (`wip`), and whether it gets an Open link (`showLink` + `url`). The two
+lists above are a locator only; when they disagree with the registry, the page is
+the bug — fix the page.
+
 ## Layout
 
 ```

shared/homepage/docs.html

@@ -56,6 +56,10 @@
     <a href="https://jelly.franksdank.cloud">Jellyfin</a>. Seerr is the front door —
     requests ride the VPN tunnel from there.</li>
     <li><strong>Books:</strong> <a href="https://books.franksdank.cloud">Calibre-Web</a> — the e-book library, with its own login.</li>
+    <li><strong>Audiobooks:</strong> <a href="https://audiobooks.franksdank.cloud">Audiobookshelf</a> &mdash; the
+    audiobook library. Same single sign-on as everything else: choose
+    <strong>Continue with authentik</strong> and each listener keeps their own
+    position.</li>
     <li><strong>Games:</strong> <a href="https://romm.franksdank.cloud">RomM</a> — ROM library and emulator collection.</li>
     <li><strong>Raw files:</strong> <a href="https://files.franksdank.cloud">Copyparty</a> — direct downloads and shares.</li>
     <li><strong>Search:</strong> <a href="https://search.franksdank.cloud">SearXNG</a> — metasearch, VPN-routed, no AI snoop. <details class="key-warn"><summary>&#9888; privacy note</summary><div class="warn-body">Searches are obfuscated, not anonymous: SearXNG hides you from the upstream engines and the VPN tunnel hides the traffic from the LAN &mdash; but the upstream search API keys are tied to Frank&rsquo;s identity. Don&rsquo;t treat it as Tor.</div></details></li>
@@ -109,6 +113,7 @@
     <li><strong>Best for:</strong> complex agentic tasks, programming, system administration, and "claw"-style personal agents.</li>
     <li><strong>Supervision:</strong> safe for autonomous, low-supervision use.</li>
     <li><strong>Warning:</strong> <details class="key-warn"><summary>&#9888; uncensored model</summary><div class="warn-body">Uncensored model: output can include adult content, content that describes harmful, hateful, or illegal acts, content concerning &ldquo;sensitive offensive cybersecurity topics&rdquo;, and other output that may carry severe legal risk. Take this warning seriously &mdash; don&rsquo;t ruin this server for everybody.</div></details></li>
+  </ul>
 
   <h2>frank-archon — the big one</h2>
   <ul>

shared/homepage/services.json

@@ -110,13 +110,13 @@
     "name": "Jellyfin",
     "category": "user",
     "section": "Media Library Apps",
-    "description": "Open source media server. Work in progress: not open to family users yet.",
+    "description": "Open source media server for the film and TV library: its own logins (no Authentik here), so ask Frank for an account.",
-    "url": "",
+    "url": "http://jelly.franksdank.cloud",
     "docs": "",
     "probe": "192.168.0.235:8096",
     "method": "http",
-    "wip": "down",
+    "wip": false,
-    "showLink": false,
+    "showLink": true,
     "art": "/img/apps/jellyfin.svg"
   },
   {
@@ -136,7 +136,7 @@
     "name": "Marreta",
     "category": "user",
     "section": "Web Apps",
-    "description": "Clean, ad-free article reader. Paste any URL, get just the article.",
+    "description": "Paywall sledgehammer: hand it an article URL and it drags the page back through the VPN with the paywall chrome, cookie wall and trackers stripped; a headless browser renders the JS-heavy ones. Best effort — hard paywalls and login walls still win.",
     "url": "http://marreta.franksdank.cloud",
     "docs": "",
     "probe": "127.0.0.1:8082",
@@ -513,9 +513,9 @@
   },
   {
     "name": "Audiobookshelf",
-    "category": "admin",
+    "category": "user",
     "section": "Media Library Apps",
-    "description": "Audiobook server for the entropy library: its own SQLite library, its own login, per-listener positions.",
+    "description": "Audiobook server for the library: sign in with your Authentik account and every listener keeps their own position.",
     "url": "http://audiobooks.franksdank.cloud/audiobookshelf/",
     "docs": "",
     "probe": "192.168.0.235:8000",