docs: Jellyfin LDAP-Auth integration (outpost + plugin) and authentik LDAP rules

serverAppConfigs-docs/log.md

@@ -11,6 +11,46 @@ timestamp: 2026-09-14
 
 # Bundle Change Log
 
+## 2026-09-01 — Jellyfin authentication moved to Authentik LDAP
+- `/dankclaw/authentik/quadlet/authentik-outpost-ldap.container` (`4ad85fa`,
+  digest-pinned in `f4ef2b8`) — new `authentik-outpost-ldap.service` on
+  Dankclaw serving LDAP :389/:636 for Jellyfin. Image
+  `ghcr.io/goauthentik/ldap` pinned by **amd64 single-platform digest**:
+  podman 5.7.0 refuses the tag because it resolves to a nested manifest
+  list ("unexpectedly received a manifest list instead of a manifest for a
+  single image") — resolve via `podman manifest inspect | jq` and pin.
+- Authentik objects provisioned via `ak shell` ORM (live, idempotent
+  get_or_create): LDAP provider `Jellyfin LDAP`, service account
+  `svc-jellyfin-ldap` + bind token, groups `jellyfin_users` /
+  `jellyfin_admins`, application `jellyfin`.
+- `/scripts/deploy-remote.sh` (`691da47`) — `authentik-outpost-ldap` added
+  to `service_is_allowed` (the deploy runner has its own allowlist beyond
+  deploy-plan.py's).
+- Two authentik-side rules proven by live bind tests (`ldapsearch` through
+  the published port):
+  1. Bind token **intent must be `verification`** — `app_password` tokens
+     are rejected by the authorization flow's password stage with
+     `Invalid password`.
+  2. Search requires the **`search_full_directory`** object permission on
+     the provider (granted via RBAC role `svc-jellyfin-ldap-search`);
+     without it the outpost returns only the bind user, so `memberOf`
+     filters match zero entries.
+- Jellyfin side (host-only, no repo change): LDAP-Auth **23.0.0.0**
+  installed from the GitHub releases zip (the `repo.jellyfin.org` stable
+  manifest path 404s), config XML at
+  `config/plugins/configurations/LDAP-Auth.xml`, username attribute `cn`
+  (authentik 2026.x maps `uid` to an opaque hash), and — the big one —
+  **`LdapSearchAttributes` is comma-separated** (`Split(',')` in the plugin
+  source; semicolons silently produce "Found no users matching X").
+  End-to-end verified with a throwaway `jellyfin_users` member
+  (`AuthenticateByName` 200, non-admin policy), then removed from both
+  authentik and the Jellyfin DB directly (its admin-token cleanup 401'd —
+  the local `dank` admin password on the live DB is Frank's, not the
+  bootstrap-era value; notated in the Jellyfin doc).
+- Docs: [[Authentik]] gained the LDAP-outpost section (objects table +
+  rules), [[Jellyfin]] gained the LDAP-Auth plugin section. Docs-only
+  commit → deploy no-op.
+
 ## 2026-09-01 — frank-default-small: two compressed-tensors FP8 swaps fail to load; Huihui restored
 - `/scripts/frank-default-small.env`, `/scripts/serve-frank-small.sh`,
   `/scripts/frank-default-small.service` (`af6cd72` → `34ab6b4` → reverted