OpenWebUI model picker narrowed to exactly frank-secondary (connections frank-large/frank-primary disabled in openai.api_configs, model table rebuilt, stale frank-small model_id retargeted to the served alias). Documented the auth-gated API surface (anonymous probes all 401; keys per account). Authentik roster gains artem (pk 16) in the human-user template.