homepage: app-card art, zealot-first order, common uncensored warning, admin identity gate

- Every app card carries hex-clipped art: 19 amber-tinted brand marks
  from the Simple Icons CDN plus 19 improvised monogram SVGs, wired via
  a per-service "art" field; homepage_config.bats pins art presence for
  all 32 apps.
- Model cards render zealot -> dragoon -> archon (registry order pinned
  in the seam).
- Dragoon and zealot share one common uncensored legal warning (adult
  content, harmful/hateful/illegal descriptions, sensitive offensive
  cybersecurity topics, severe legal risk, "don't ruin this server for
  everybody"), hover label on card and docs.
- Archon gets a bordered red permission callout: ask Frank before use.
- SearXNG obfuscation-not-anonymity note moved to a card-level hover
  warning (.svc-warn) and a docs hover note.
- Gitea: self-service signup flow; no need to ask Frank.
- Footer docs/admin/account-settings become glowing bordered buttons;
  the admin button is shown only to homepage-admins members via a new
  Caddy /whoami endpoint echoing the outpost-injected X-Authentik-*
  headers (spoof-proof; the /admin* 403 stays the real gate). e2e pins
  both sides.
- Docs naming swept: Protoss names primary, bracketed api ids, explicit
  note that a future switchover renames the ids themselves.

tests/e2e/specs/10-homepage.spec.ts

@@ -47,8 +47,11 @@ test("standard user is denied the admin panel (RBAC)", async ({ page }) => {
   expect(resp.status()).toBe(403);
   expect(await resp.text()).toContain("Forbidden: homepage admins only");
 
-  // The footer link a standard user can click also dead-ends at the gate.
+  // The admin button is identity-gated: /whoami reports the authentik
+  // groups, and the page hides the button from non-admins (the server-side
+  // 403 above stays the real gate). Direct navigation dead-ends all the same.
   await page.goto("/");
-  await page.locator('footer a[href="/admin/"]').click();
+  await expect(page.locator("#admin-link")).toBeHidden();
+  await page.goto("/admin/");
   await expect(page.locator("body")).toContainText("Forbidden: homepage admins only");
 });