feat(rank6): node-exporter renders from a template; guard chain is one snippet

- service-map render node-exporter-unit --host H: the MIRROR pair comment
  ('keep this file in step') becomes a template. Per-host title, LAN
  address from the hosts map, port from the node-<host> scrape job. Both
  tracked quadlets are now rendered artifacts; check_drift gates them.
- dankclaw/Caddyfile: the nine verbatim Anubis pre-auth chains
  (reverse_proxy anubis:8923 + X-Real-Ip) collapse into the (guarded)
  named snippet; guarded vhosts are 'import guarded'. Validated with real
  caddy 2.11.7 (import resolution clean; the stock image stops at the
  porkbun module and the git basicauth placeholder, as designed).
- vhost-scoped guard greps (authentik, homepage_caddy, marreta_quadlet)
  now pin 'import guarded' in the vhost block.
- Service Inventory + Authentik docs carry the new laws.

tests/marreta_quadlet.bats

@@ -112,11 +112,11 @@ GLUETUN="$REPO_ROOT/dankclaw/searxng/quadlet/gluetun.container"
     # Public edge: the vhost must proxy to the challenge proxy, not straight to the app.
     awk '
         /^marreta\.franksdank\.cloud \{/ { inblk=1 }
-        inblk && /reverse_proxy anubis:8923/ { challenge=1 }
+        inblk && /import guarded/ { challenge=1 }
         inblk && /^\}/ { inblk=0 }
         END { exit challenge ? 0 : 1 }
     ' "$REPO_ROOT/dankclaw/Caddyfile" \
-        || { echo "marreta vhost must reverse_proxy anubis:8923"; return 1; }
+        || { echo "marreta vhost must import the guarded chain (the one named Anubis snippet)"; return 1; }
 }
 
 @test "the Caddyfile post-auth listener routes marreta to the published 8082" {