Persist TB-006 batch 2 media SSO and batch 1 auth fixes to the repo.

Media sites get Caddy forward_auth; Authentik scripts cover all proxy providers. BookStack OIDC and Plane admin routing fixes included, plus ops scripts for external auth on valhalla.

Caddyfile

@@ -81,27 +81,57 @@ requests.ginnoir.com {
 # =============================================================
 sonarr.ginnoir.com {
 	import internal_only
-	reverse_proxy sonarr:8989
+	route {
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy sonarr:8989
+		}
+	}
 }
 
 radarr.ginnoir.com {
 	import internal_only
-	reverse_proxy radarr:7878
+	route {
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy radarr:7878
+		}
+	}
 }
 
 bazarr.ginnoir.com {
 	import internal_only
-	reverse_proxy bazarr:6767
+	route {
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy bazarr:6767
+		}
+	}
 }
 
 prowlarr.ginnoir.com {
 	import internal_only
-	reverse_proxy prowlarr:9696
+	route {
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy prowlarr:9696
+		}
+	}
 }
 
 tautulli.ginnoir.com {
 	import internal_only
-	reverse_proxy tautulli:8181
+	route {
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy tautulli:8181
+		}
+	}
 }
 
 # =============================================================
@@ -109,27 +139,57 @@ tautulli.ginnoir.com {
 # =============================================================
 qbittorrent.ginnoir.com {
 	import internal_only
-	reverse_proxy qbittorrent:3232
+	route {
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy qbittorrent:3232
+		}
+	}
 }
 
 deluge.ginnoir.com {
 	import internal_only
-	reverse_proxy deluge:8112
+	route {
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy deluge:8112
+		}
+	}
 }
 
 nzbget.ginnoir.com {
 	import internal_only
-	reverse_proxy nzbget:6789
+	route {
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy nzbget:6789
+		}
+	}
 }
 
 whisparr.ginnoir.com {
 	import internal_only
-	reverse_proxy whisparr:6969
+	route {
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy whisparr:6969
+		}
+	}
 }
 
 stash.ginnoir.com {
 	import internal_only
-	reverse_proxy stash:6970
+	route {
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy stash:6970
+		}
+	}
 }
 
 # =============================================================
@@ -344,14 +404,24 @@ docs.ginnoir.com {
 }
 
 plane.ginnoir.com {
-	handle /api/* {
-		reverse_proxy plane_api:8000
-	}
-	handle /auth/* {
-		reverse_proxy plane_api:8000
-	}
-	handle {
-		reverse_proxy plane_web:3000
+	route {
+		import authentik_outpost
+		handle /api/* {
+			import authentik_forward_auth
+			reverse_proxy plane_api:8000
+		}
+		handle /auth/* {
+			import authentik_forward_auth
+			reverse_proxy plane_api:8000
+		}
+		handle /god-mode/* {
+			import authentik_forward_auth
+			reverse_proxy plane_admin:3000
+		}
+		handle {
+			import authentik_forward_auth
+			reverse_proxy plane_web:3000
+		}
 	}
 }