feat(rank6): node-exporter renders from a template; guard chain is one snippet

- service-map render node-exporter-unit --host H: the MIRROR pair comment
  ('keep this file in step') becomes a template. Per-host title, LAN
  address from the hosts map, port from the node-<host> scrape job. Both
  tracked quadlets are now rendered artifacts; check_drift gates them.
- dankclaw/Caddyfile: the nine verbatim Anubis pre-auth chains
  (reverse_proxy anubis:8923 + X-Real-Ip) collapse into the (guarded)
  named snippet; guarded vhosts are 'import guarded'. Validated with real
  caddy 2.11.7 (import resolution clean; the stock image stops at the
  porkbun module and the git basicauth placeholder, as designed).
- vhost-scoped guard greps (authentik, homepage_caddy, marreta_quadlet)
  now pin 'import guarded' in the vhost block.
- Service Inventory + Authentik docs carry the new laws.

tests/service_inventory.bats

@@ -123,3 +123,16 @@ if problems:
     sys.exit(1)
 PYEOF
 }
+
+@test "inventory: the node-exporter unit is a per-host rendered template" {
+    # Rank 6: the two node-exporter quadlets were a MIRROR pair kept in
+    # step by a comment. The render is now the law on both hosts.
+    for host in dankclaw dankserver; do
+        run bash -c "cd '$REPO_ROOT' && python3 scripts/service-map.py render node-exporter-unit --host $host | \
+            diff -u $host/observability/quadlet/node-exporter.container -"
+        [ "$status" -eq 0 ] || { echo "$host unit drift"; return 1; }
+    done
+    # Hand-edited copies fail the drift gate:
+    grep -q "Keep this file in step" dankserver/observability/quadlet/node-exporter.container && return 1
+    true
+}