docs(jellyfin,authentik): the LDAP admin filter is inert; the auth door lives in Users

Diagnosed 'authentik login does not work in Jellyfin' 2026-11-04: nothing was
broken. The Jellyfin admin account 'dank' is a LOCAL-provider account, and the
operator's authentik identity (akadmin) was not in jellyfin_users, so the plugin
search found nothing and Jellyfin fell back to local auth - same UI message,
opposite fix. akadmin is now in jellyfin_users (directory data, DB-owned).

- Jellyfin: the admin-filter law (DN match, so a group-OU base grants nothing;
  memberOf shape is the working one), the AuthenticationProviderId diagnostic,
  re-verified LDAP path (bind + memberOf search from Dankserver).
- Authentik Outpost Reference: settle the token-intent argument (the plugin
  sends a password, never a token), verify the bind DN live, and record the
  instruments/traps: the outpost journal never shows a bind, Event is keyed by
  created/action, Outpost has no apps, and piping ak shell steals its heredoc.
- Authentik: stop restating the LDAP outpost digest - the unit file owns it.

serverAppConfigs-docs/Infrastructure/Authentik.md

@@ -145,18 +145,17 @@ relying-party quirks are reference lookup: [[Authentik Outpost Reference]].
 The second outpost — `dankclaw/authentik/quadlet/authentik-outpost-ldap.container`
 → `authentik-outpost-ldap.service`, one of the five units in this stack —
 serves LDAP for Jellyfin's LDAP-Auth plugin (`enabled`=generated, `active`
-`Restart=always`, container up, 2026-10-18). The image is pinned by its **amd64
-single-platform digest**
-`ghcr.io/goauthentik/ldap@sha256:2e7b259eb8c37faac916946ddf48ec681ee9d3a9f724fe8521bf161973f13cf9`
-(`dankclaw/authentik/quadlet/authentik-outpost-ldap.container:26`, matching the
-running image in `podman ps`, 2026-10-18). The digest in this page before 2026-10-18
-(`…fa33bc8f…`) is superseded. The reason for pinning a digest at all: podman
-5.7.0 refuses the plain tag because it resolves to a *nested* manifest list
-(index → per-platform manifest lists) — `unexpectedly received a manifest list
-instead of a manifest for a single image` — first hit on `:2026.8.0`, still the
-rule at the current `2026.8.3` pin. Resolve once with `podman manifest inspect
-<image> | jq -r '.manifests[] | select(.platform.architecture=="amd64") |
-.digest'` and pin that digest.
+`Restart=always`, container up, re-checked 2026-11-04). **The image pin has one
+owner: the `Image=` line of
+`dankclaw/authentik/quadlet/authentik-outpost-ldap.container`** — never restate
+the digest here, because every pin bump turns this page into a lie (the digest
+cited here went stale twice: `…fa33bc8f…`, then `…2e7b259e…`). The reason a
+digest is pinned at all: podman 5.7.0 refuses the plain tag because it resolves
+to a *nested* manifest list (index → per-platform manifest lists) —
+`unexpectedly received a manifest list instead of a manifest for a single image`
+— first hit on `:2026.8.0` and still the rule. Resolve once with
+`podman manifest inspect <image> | jq -r '.manifests[] |
+select(.platform.architecture=="amd64") | .digest'` and pin that digest.
 
 - Ports **389** (ldap) and **636** (ldaps) publish on the LAN
   (`PublishPort=389:3389`, `636:6636`