docs(audiobookshelf): the wide listener default is a decision, not a defect

The SSO paragraph left "whether an access policy should be bound to the
audiobookshelf application" open, which invites the next agent to relitigate
it. Frank's answer of 2026-11-03: accepted on purpose — every signer becomes a
listener with all libraries and downloads, no access policy on the application,
narrowing done per account in Settings -> Users. What that makes load-bearing is
authentik's own signup flow, now named in the same paragraph as the thing that
must stay operator-only.

serverAppConfigs-docs/Dankserver/Audiobookshelf.md

@@ -146,12 +146,15 @@ the local form, and the phone app offers SSO on its server-address screen. The l
 
 With `authOpenIDAutoRegister` on, a first sign-in creates the account and the claim alone
 decides its type — and the claim always carries `user`, so **the IdP is now the library gate**:
-any authentik account that can reach this application becomes a listener. That is the intent
-(the household signs in with the accounts it already has), which makes two things worth
-checking when they change: whether authentik's own invitation/signup flow stays something only
-Frank drives, and whether an access policy should be bound to the `audiobookshelf` application
-to narrow who may even reach the login. Revoking one person is a disable/delete of their ABS
-user; revoking everyone is that policy.
+any authentik account that can reach this application becomes a listener. That is the
+intent (the household signs in with the accounts it already has), and its breadth is
+accepted on purpose: no access policy is bound to the `audiobookshelf` application, and
+the wide auto-registered default (every library, downloads on) is **not a defect to fix** —
+Frank's call, 2026-11-03. Narrowing stays a per-account judgement in **Settings → Users**.
+The one thing still worth watching is authentik's own invitation/signup flow: it must
+remain something only Frank drives, because an account created there is a listener the
+moment it signs in. Revoking one person is a disable/delete of their ABS user; revoking
+everyone is that signup flow.
 
 Both halves — authentik's provider row and ABS's settings — are asserted end to end by the Playwright gate named in *Verification*. `23-` signs in as `qa-e2e-admin` and must land inside the app with site-admin rights; `24-` signs in as the standard identity, which is in no Audiobookshelf group, and must land as a listener. Together they pin the escalation and the default: a mapping that stops granting silently locks the household out, and a mapping that over-grants turns the household into site admins.