e2e: Playwright suite for homepage + guard chain; RBAC gate on /admin; fix stale service links

dankclaw/Caddyfile

@@ -243,9 +243,19 @@ http://:8017 {
 	@home host www.franksdank.cloud
 	handle @home {
 		root * /srv/homepage
+		# RBAC (2026-09-01): /admin requires membership in the homepage-admins
+		# authentik group. In proxy-provider mode the outpost injects
+		# X-Authentik-Groups on its upstream request to this listener and strips
+		# any client-supplied X-Authentik-* headers first, so browsers cannot
+		# spoof it. Regex is a substring match, insensitive to the group-list
+		# separator.
 		handle /admin* {
-			try_files /admin.html
-			file_server
+			@adminok header_regexp X-Authentik-Groups homepage-admins
+			handle @adminok {
+				try_files /admin.html
+				file_server
+			}
+			respond "Forbidden: homepage admins only" 403
 		}
 		@data path /services.json /status.json /app.js /style.css /deployed.js
 		handle @data {