feat(rank6): node-exporter renders from a template; guard chain is one snippet

- service-map render node-exporter-unit --host H: the MIRROR pair comment
  ('keep this file in step') becomes a template. Per-host title, LAN
  address from the hosts map, port from the node-<host> scrape job. Both
  tracked quadlets are now rendered artifacts; check_drift gates them.
- dankclaw/Caddyfile: the nine verbatim Anubis pre-auth chains
  (reverse_proxy anubis:8923 + X-Real-Ip) collapse into the (guarded)
  named snippet; guarded vhosts are 'import guarded'. Validated with real
  caddy 2.11.7 (import resolution clean; the stock image stops at the
  porkbun module and the git basicauth placeholder, as designed).
- vhost-scoped guard greps (authentik, homepage_caddy, marreta_quadlet)
  now pin 'import guarded' in the vhost block.
- Service Inventory + Authentik docs carry the new laws.

tests/homepage_caddy.bats

@@ -51,7 +51,7 @@ setup() {
     # domain never enters the chain (it redirects at the TLS edge first).
     local block
     block=$(awk '/^www\.franksdank\.cloud[[:space:]]*\{/,/^}/' "$CADDY")
-    echo "$block" | grep -q 'reverse_proxy anubis:8923'
+    echo "$block" | grep -q 'import guarded'
     # forwards accepted traffic to; Host survives the hop, so per-vhost
     # routing resumes there — guarded vhosts proxy the whole request
     # through Authentik, which forwards authenticated traffic back on the