docs(authentik): provision kirby/ry/nic/debo/freya (pk 17-21); OWU pending-role first-login flip law

serverAppConfigs-docs/log.md

@@ -1,5 +1,24 @@
 # Bundle Change Log
 
+## 2026-10-09
+- **Live — five authentik human accounts provisioned (Dankclaw, `ak shell`
+  ORM, no repo objects):** kirby (pk 17), ry (18), nic (19), debo (20),
+  freya (21), each `<user>@franksdank.cloud` in the human-user template shape
+  (`is_active=True`, password via `set_password` on stdin only, groups
+  `Non-Admin Users` + `jellyfin_users` + `openwebui_users`). Verified through
+  the exact PasswordStage code path (`authenticate()` accepts each password and
+  rejects a wrong one) and `app_entitlements(open-webui)` → `Open WebUI Users`
+  for all five (identical to the ridley precedent). No `proxysession` rows
+  existed for them — groups were set before any login, so no claim purge was
+  due. Downstream: Jellyfin visibility rides the LDAP outpost cache (expect
+  lag); OpenWebUI mints their accounts as role `pending` on first login.
+- `/serverAppConfigs-docs/Infrastructure/Authentik.md` — human-user template
+  census extended with pk 17–21.
+- `/serverAppConfigs-docs/Dankclaw/OpenWebUI.md` — new SSO bullet: first login
+  lands as role `pending` (`ui.default_user_role=pending` in the config DB),
+  the role-flip SQL, and the global `access_grant` (`principal_id='*'`) fact
+  that makes the picker model visible to every `role='user'` account.
+
 ## 2026-10-08
 - **frank-primary (Dankserver): Swift1.5-Qwen3.8-Flash-Next GPTQ w4 —
   the radiance quantization campaign.** ukisai's BF16 checkpoint (335.3