feat(devicebackup): UrBackup for the Windows laptops, Time Machine staging for the Macs

New devicebackup stack: UrBackup 2.5.x (pinned, watchtower off) in internet
mode on :55415 so laptops back up on the LAN and over the tailnet; web UI
only via Caddy + Authentik forward_auth (provider homelab-urbackup, pk 41).

MacBooks (tm-hub, tm-wif) use Time Machine on the host smbd, which already
owns :445. Shares are staged in /etc/samba/smb.conf.timemachine-pending and
not yet applied; README has the apply command and client setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Caddyfile

@@ -473,6 +473,18 @@ backup.ginnoir.com {
 	}
 }
 
+# UrBackup web UI. Clients talk to :55415 directly, not through Caddy.
+urbackup.ginnoir.com {
+	import internal_only
+	route {
+		import authentik_outpost
+		handle {
+			import authentik_forward_auth
+			reverse_proxy urbackup:55414
+		}
+	}
+}
+
 router.ginnoir.com {
 	import internal_only
 	reverse_proxy 192.168.1.1