Persist TB-006 batch 2 media SSO and batch 1 auth fixes to the repo.

Media sites get Caddy forward_auth; Authentik scripts cover all proxy providers. BookStack OIDC and Plane admin routing fixes included, plus ops scripts for external auth on valhalla.

scripts/patch-deluge-auth.py

@@ -0,0 +1,26 @@
+from pathlib import Path
+
+path = Path("/lsiopy/lib/python3.12/site-packages/deluge/ui/web/auth.py")
+text = path.read_text()
+if "homelab external auth" in text:
+    print("already patched")
+    raise SystemExit(0)
+
+text = text.replace(
+    "        return s.hexdigest() == config['pwd_sha1']",
+    "        return True  # homelab external auth",
+    1,
+)
+old_login = """        if self.check_password(password):
+            log.info('Login success (ClientIP %s)', __request__.getClientIP())
+            return self._create_session(__request__)
+        else:
+            log.error('Login failed (ClientIP %s)', __request__.getClientIP())
+            return False"""
+new_login = """        log.info('Login success (ClientIP %s) [homelab external auth]', __request__.getClientIP())
+        return self._create_session(__request__)"""
+if old_login not in text:
+    raise SystemExit("login() pattern not found")
+text = text.replace(old_login, new_login, 1)
+path.write_text(text)
+print("patched auth.py")