feat(rank6): node-exporter renders from a template; guard chain is one snippet

- service-map render node-exporter-unit --host H: the MIRROR pair comment
  ('keep this file in step') becomes a template. Per-host title, LAN
  address from the hosts map, port from the node-<host> scrape job. Both
  tracked quadlets are now rendered artifacts; check_drift gates them.
- dankclaw/Caddyfile: the nine verbatim Anubis pre-auth chains
  (reverse_proxy anubis:8923 + X-Real-Ip) collapse into the (guarded)
  named snippet; guarded vhosts are 'import guarded'. Validated with real
  caddy 2.11.7 (import resolution clean; the stock image stops at the
  porkbun module and the git basicauth placeholder, as designed).
- vhost-scoped guard greps (authentik, homepage_caddy, marreta_quadlet)
  now pin 'import guarded' in the vhost block.
- Service Inventory + Authentik docs carry the new laws.

serverAppConfigs-docs/Architecture/Service Inventory.md

@@ -32,6 +32,7 @@ Now there is **one inventory and one reader**:
 |`scripts/deploy-remote.sh` (`service_is_allowed`)|same|
 |`scripts/test-changed.sh`|`seams [paths...]` — a service's declared `tests` are its seams|
 |`dankclaw/pihole/addn-hosts`|`render pihole-hosts` — the tracked file is a rendered artifact|
+|`*/observability/quadlet/node-exporter.container`|`render node-exporter-unit --host H` — the MIRROR pair became one template; per-host title, LAN address (hosts map), and port (scrape job) fill it|
 |Prometheus scrape jobs, LAN DNS, homepage probes|`check` compares the tracked configs against the inventory's `scrape`/`dns`/`probe` fields (drift gate)|
 
 Selection rules the engine encodes (see `tests/fixtures/service-plan-golden.tsv`,
@@ -64,8 +65,9 @@ the pinned characterization of every tracked path × every target):
 - **paths** — every claimed `files`/`dirs`/`retires` glob matches ≥1 tracked file;
 - **compose** — the container names in each host's `compose.yaml` have exactly
   one quadlet owner (the [[Quadlet Lifecycle]] two-owners trap);
-- **drift** — `addn-hosts` equals its render; the Prometheus job set, the DNS
-  names, and the homepage probe ports equal the inventory's fields.
+- **drift** — `addn-hosts` equals its render, each tracked node-exporter unit
+  equals its per-host render; the Prometheus job set, the DNS names, and the
+  homepage probe ports equal the inventory's fields.
 
 ## 3. Adding, moving, retiring a service