feat(rank6): node-exporter renders from a template; guard chain is one snippet

- service-map render node-exporter-unit --host H: the MIRROR pair comment
  ('keep this file in step') becomes a template. Per-host title, LAN
  address from the hosts map, port from the node-<host> scrape job. Both
  tracked quadlets are now rendered artifacts; check_drift gates them.
- dankclaw/Caddyfile: the nine verbatim Anubis pre-auth chains
  (reverse_proxy anubis:8923 + X-Real-Ip) collapse into the (guarded)
  named snippet; guarded vhosts are 'import guarded'. Validated with real
  caddy 2.11.7 (import resolution clean; the stock image stops at the
  porkbun module and the git basicauth placeholder, as designed).
- vhost-scoped guard greps (authentik, homepage_caddy, marreta_quadlet)
  now pin 'import guarded' in the vhost block.
- Service Inventory + Authentik docs carry the new laws.

serverAppConfigs-docs/Infrastructure/Authentik.md

@@ -357,11 +357,15 @@ client → TLS edge → Anubis :8923 → outpost decision → internal
    routing matches on hostname, verified 2026-09-02).
    `internal_host = http://caddy:8017`, all three flows set, and an
    Application attached — the two provisioning rules above.
-2. **Route flip in ONE commit/deploy**: the vhost becomes
-   `reverse_proxy anubis:8923` with `header_up X-Real-Ip {remote_host}`, and
-   inside the `http://:8017` listener add `@<svc> host <vhost>` +
+2. **Route flip in ONE commit/deploy**: the vhost body becomes
+   `import guarded` — the named snippet at the top of the Caddyfile is the
+   whole pre-auth chain (`reverse_proxy anubis:8923` + `header_up X-Real-Ip
+   {remote_host}`; rank 6 retired the nine verbatim copies), and inside the
+   `http://:8017` listener add `@<svc> host <vhost>` +
    `handle @<svc> { reverse_proxy <upstream> }`. Anubis guard set, Caddy TLS
    edge, `:8017` routing table, and provider list change together.
+   `tests/caddyfile.bats` pins that the chain exists exactly once as the
+   `(guarded)` snippet and every guarded vhost imports it.
 3. Deploy via the repo deploy flow (commit first; deploy pushes main itself).
 
 **Verification (all three):**