Merge pull request 'docs(audiobookshelf): the wide listener default is a decision, not a defect' (#136) from docs/abs-listener-default-decision into main

The SSO paragraph left "whether an access policy should be bound to the
audiobookshelf application" open, which invites the next agent to relitigate
it. Frank's answer of 2026-11-03: accepted on purpose — every signer becomes a
listener with all libraries and downloads, no access policy on the application,
narrowing done per account in Settings -> Users. What that makes load-bearing is
authentik's own signup flow, now named in the same paragraph as the thing that
must stay operator-only.

serverAppConfigs-docs/Dankserver/Audiobookshelf.md

@@ -146,12 +146,15 @@ the local form, and the phone app offers SSO on its server-address screen. The l
 
 With `authOpenIDAutoRegister` on, a first sign-in creates the account and the claim alone
 decides its type — and the claim always carries `user`, so **the IdP is now the library gate**:
-any authentik account that can reach this application becomes a listener. That is the intent
-(the household signs in with the accounts it already has), which makes two things worth
-checking when they change: whether authentik's own invitation/signup flow stays something only
-Frank drives, and whether an access policy should be bound to the `audiobookshelf` application
-to narrow who may even reach the login. Revoking one person is a disable/delete of their ABS
-user; revoking everyone is that policy.
+any authentik account that can reach this application becomes a listener. That is the
+intent (the household signs in with the accounts it already has), and its breadth is
+accepted on purpose: no access policy is bound to the `audiobookshelf` application, and
+the wide auto-registered default (every library, downloads on) is **not a defect to fix** —
+Frank's call, 2026-11-03. Narrowing stays a per-account judgement in **Settings → Users**.
+The one thing still worth watching is authentik's own invitation/signup flow: it must
+remain something only Frank drives, because an account created there is a listener the
+moment it signs in. Revoking one person is a disable/delete of their ABS user; revoking
+everyone is that signup flow.
 
 Both halves — authentik's provider row and ABS's settings — are asserted end to end by the Playwright gate named in *Verification*. `23-` signs in as `qa-e2e-admin` and must land inside the app with site-admin rights; `24-` signs in as the standard identity, which is in no Audiobookshelf group, and must land as a listener. Together they pin the escalation and the default: a mapping that stops granting silently locks the household out, and a mapping that over-grants turns the household into site admins.