Verified live: AuthenticationMethod=None + AuthenticationRequired=Enabled on all five arrs; unauthenticated API probes return 401 both locally and through the vhosts. Also records the as-built divergences (entropy mounts, LA timezone, readarr tag pin, prowlarr mount fix) that supersede the design compose.