caddy: move ComfyUI behind the Anubis + Authentik guard chain

comfyui.franksdank.cloud was exempt (direct reverse_proxy to comfyui:8188).
The comfyui-proxy proxy provider was created on the embedded outpost first
(internal_host http://caddy:8017, flows copied from hermes-proxy), then the
vhost flips onto the guard chain and authenticated traffic routes back via a
@comfy host match. ComfyUI has no auth of its own; this closes the last
unguarded admin surface on the internal hosts.

dankclaw/Caddyfile

@@ -22,9 +22,11 @@
 # CHALLENGE everyone else) → Caddy's internal listener http://:8016 (auth
 # decision; Host headers survive every hop) → authenticated traffic is
 # forwarded back to http://:8017 and routed straight to the app.
-# Apps with their own auth (Grafana, Gitea, OpenWebUI, ComfyUI, Jellyfin,
+# Apps with their own auth (Grafana, Gitea, OpenWebUI, Jellyfin, *arr, Pi-hole)
-# *arr, Pi-hole) and the Authentik IdP itself (auth.franksdank.cloud — its
+# and the Authentik IdP itself (auth.franksdank.cloud — its login flow must never
-# login flow must never sit behind a challenge) are exempt by construction:
+# sit behind a challenge) are exempt by construction: their vhosts never route
+# through Anubis. ComfyUI left this exempt set on 2026-08-31: it now sits behind
+# the guard chain with the comfyui-proxy provider registered on the embedded outpost.
 # their vhosts never route through Anubis. The basicauth hash is a
 # placeholder; deploy.sh renders the real hash (CADDY_BASICAUTH_HASH from the
 # host .env, git-ignored) into /home/dank/Containers/caddy/Caddyfile, which
@@ -102,9 +104,11 @@ search.franksdank.cloud {
 	}
 }
 
-# --- ComfyUI ---
+:# --- ComfyUI (guarded: Anubis → Authentik; comfyui-proxy provider, internal_host caddy:8017) ---
 comfyui.franksdank.cloud {
-	reverse_proxy comfyui:8188
+	reverse_proxy anubis:8923 {
+		header_up X-Real-Ip {remote_host}
+	}
 }
 
 # --- OpenWebUI (quadlet on slirp4netns; published 3005) ---
@@ -286,6 +290,10 @@ http://:8017 {
 	handle @hermes {
 		reverse_proxy 192.168.0.143:9119
 	}
+	@comfy host comfyui.franksdank.cloud
+	handle @comfy {
+		reverse_proxy comfyui:8188
+	}
 
 	@prometheus host prometheus.franksdank.cloud
 	handle @prometheus {