docs(authentik): provision kirby/ry/nic/debo/freya (pk 17-21); OWU pending-role first-login flip law

serverAppConfigs-docs/Dankclaw/OpenWebUI.md

@@ -184,6 +184,18 @@ browser-driven and only touches the two exempt vhosts (`ai.` and `auth.`).
   into the existing local account with the same email — the pre-SSO admin
   (frank8465@protonmail.com) keeps its data. `ENABLE_OAUTH_SIGNUP=true` lets
   other `openwebui_users` create accounts on first login.
+- **First login mints role `pending`.** `ui.default_user_role=pending` (config
+  DB, verified 2026-10-09), so a freshly-provisioned `openwebui_users` account
+  completes SSO and then cannot chat (picker empty) until its role is flipped:
+  `UPDATE "user" SET role='user' WHERE email='<user>@franksdank.cloud';` —
+  run with host `python3` over ssh against
+  `/home/dank/Containers/open-webui/data/webui.db` (no `sqlite3` CLI on
+  Dankclaw; table is `user`, singular; no `active` column). No per-user model
+  grant is needed: the picker model `frank-secondary` carries the global
+  `access_grant` row `(model, frank-secondary, user, *, read)`, so any
+  `role='user'` account sees it. Flip on FIRST-LOGIN SIGHTING — the row does
+  not exist until the account signs in (2026-10-09: five provisioned accounts
+  had no row).
 - **IdP reachability:** the container is on its own bridge (10.89.3.0/24) and
   cannot reach `authentik-server:9000` by name. It reaches the IdP over the
   public URL `https://auth.franksdank.cloud` — Caddy publishes `0.0.0.0:443`

serverAppConfigs-docs/Infrastructure/Authentik.md

@@ -451,8 +451,9 @@ access is decided entirely by GROUP MEMBERSHIP consumed downstream —
   (filter `(memberOf=cn=jellyfin_users,ou=groups,dc=franksdank,dc=cloud)`).
 - `Non-Admin Users` = the plain-user marker group (precedents: qa-e2e, and
   every human account).
-- **The human-user template** (ridley, kassie, alex, artem — kassie and alex
-  created 2026-10-08, artem (pk 16) created 2026-10-07): `username` +
+- **The human-user template** (ridley, kassie, alex, artem, kirby, ry, nic,
+  debo, freya — kirby/ry/nic/debo/freya (pk 17–21) created 2026-10-09, kassie
+  and alex created 2026-10-08, artem (pk 16) created 2026-10-07): `username` +
   `<user>@franksdank.cloud` + display name +
   `is_active=True` + the password set via `set_password`, membership in
   `Non-Admin Users` + `jellyfin_users` + `openwebui_users`. `alex` was

serverAppConfigs-docs/log.md

@@ -1,5 +1,24 @@
 # Bundle Change Log
 
+## 2026-10-09
+- **Live — five authentik human accounts provisioned (Dankclaw, `ak shell`
+  ORM, no repo objects):** kirby (pk 17), ry (18), nic (19), debo (20),
+  freya (21), each `<user>@franksdank.cloud` in the human-user template shape
+  (`is_active=True`, password via `set_password` on stdin only, groups
+  `Non-Admin Users` + `jellyfin_users` + `openwebui_users`). Verified through
+  the exact PasswordStage code path (`authenticate()` accepts each password and
+  rejects a wrong one) and `app_entitlements(open-webui)` → `Open WebUI Users`
+  for all five (identical to the ridley precedent). No `proxysession` rows
+  existed for them — groups were set before any login, so no claim purge was
+  due. Downstream: Jellyfin visibility rides the LDAP outpost cache (expect
+  lag); OpenWebUI mints their accounts as role `pending` on first login.
+- `/serverAppConfigs-docs/Infrastructure/Authentik.md` — human-user template
+  census extended with pk 17–21.
+- `/serverAppConfigs-docs/Dankclaw/OpenWebUI.md` — new SSO bullet: first login
+  lands as role `pending` (`ui.default_user_role=pending` in the config DB),
+  the role-flip SQL, and the global `access_grant` (`principal_id='*'`) fact
+  that makes the picker model visible to every `role='user'` account.
+
 ## 2026-10-08
 - **frank-primary (Dankserver): Swift1.5-Qwen3.8-Flash-Next GPTQ w4 —
   the radiance quantization campaign.** ukisai's BF16 checkpoint (335.3