feat(caddy): serve Audiobookshelf at a guarded abs.franksdank.cloud

Provider-first exposure: the IdP row (proxy provider abs-proxy + application
"Audiobookshelf Guard", claimed by the embedded outpost) already exists, so the
route can ship. The site block proxies everything to anubis:8923 like every other
guarded vhost, and the post-auth :8017 handler routes the host to
192.168.0.235:8000. The container carries ROUTER_BASE_PATH=/audiobookshelf, so
the app has no root: the bare / is redirected onto the base path inside the
post-auth handler, never pre-auth, so an anonymous client only ever meets the
gate.

dankclaw/Caddyfile

@@ -264,6 +264,19 @@ files.franksdank.cloud {
 	}
 }
 
+# --- Audiobookshelf (guarded) ---
+# Anubis → Authentik → app, like romm/files. The container carries
+# ROUTER_BASE_PATH=/audiobookshelf, so this vhost serves the app under that
+# path; the bare root is redirected onto it in the post-auth listener, never
+# pre-auth. Guard state in the IdP: proxy provider `abs-proxy`
+# (external_host https://abs.franksdank.cloud/, internal_host http://caddy:8017,
+# application "Audiobookshelf Guard"), claimed by the embedded outpost.
+abs.franksdank.cloud {
+	reverse_proxy anubis:8923 {
+		header_up X-Real-Ip {remote_host}
+	}
+}
+
 # --- Jellyfin ---
 jelly.franksdank.cloud {
 	reverse_proxy 192.168.0.235:8096
@@ -410,6 +423,15 @@ http://:8017 {
 		reverse_proxy 192.168.0.235:3923
 	}
 
+	@abs host abs.franksdank.cloud
+	handle @abs {
+		# The app answers only under its ROUTER_BASE_PATH; the bare root is a
+		# convenience hop, taken post-auth so nothing reaches the app
+		# pre-authentication.
+		redir / /audiobookshelf/ permanent
+		reverse_proxy 192.168.0.235:8000
+	}
+
 	@prowlarr host prowlarr.franksdank.cloud
 	handle @prowlarr {
 		reverse_proxy 192.168.0.112:9696