Add Caddy bypasses so MCP can reach *arr and Uptime Kuma through Authentik.

TB-006 forward_auth blocks machine clients with HTML/302; route /api on *arr
sites and /api plus socket.io on uptime (LAN/tailnet only) before forward_auth.
Also add Cursor interview-first rule and small Authentik/FreshRSS debug helpers.

.cursor/rules/interview-first-planning.mdc

@@ -0,0 +1,16 @@
+---
+description: Interview-first planning for ADHD — applies to plans/ and task briefs in this repo
+globs: plans/**/*
+alwaysApply: false
+---
+
+# Interview-first planning (this repo)
+
+When working on files under `plans/`:
+
+- Lead with conversation questions, not dense specs
+- Each task brief's **Talk first** section is the real interface
+- Record outcomes in **What we decided** after chatting with Matt
+- Dropping a task is success — mark Decision: dropped
+
+See also: user rule `interview-first-planning` (global, always apply).