docs(openwebui,authentik): frank-secondary-only picker, API gating, artem account

OpenWebUI model picker narrowed to exactly frank-secondary (connections
frank-large/frank-primary disabled in openai.api_configs, model table rebuilt,
stale frank-small model_id retargeted to the served alias). Documented the
auth-gated API surface (anonymous probes all 401; keys per account).
Authentik roster gains artem (pk 16) in the human-user template.

serverAppConfigs-docs/Infrastructure/Authentik.md

@@ -451,8 +451,9 @@ access is decided entirely by GROUP MEMBERSHIP consumed downstream —
   (filter `(memberOf=cn=jellyfin_users,ou=groups,dc=franksdank,dc=cloud)`).
 - `Non-Admin Users` = the plain-user marker group (precedents: qa-e2e, and
   every human account).
-- **The human-user template** (ridley, kassie, alex — the last two created
-  2026-10-08): `username` + `<user>@franksdank.cloud` + display name +
+- **The human-user template** (ridley, kassie, alex, artem — kassie and alex
+  created 2026-10-08, artem (pk 16) created 2026-10-07): `username` +
+  `<user>@franksdank.cloud` + display name +
   `is_active=True` + the password set via `set_password`, membership in
   `Non-Admin Users` + `jellyfin_users` + `openwebui_users`. `alex` was
   recreated from scratch on 2026-10-08 into this shape (the old row had an