14-guard.spec.ts: every authentik-guarded vhost (www, search, romm, files, seerr, grafana, prometheus, loki) must challenge an unauthenticated direct navigation; plex is asserted exempt (PMS answers directly, no IdP form). 11-admin.spec.ts: admin direct-nav to grafana/prometheus/loki passes through with host preserved and no uidField challenge.