Add Caddy bypasses so MCP can reach *arr and Uptime Kuma through Authentik.

TB-006 forward_auth blocks machine clients with HTML/302; route /api on *arr
sites and /api plus socket.io on uptime (LAN/tailnet only) before forward_auth.
Also add Cursor interview-first rule and small Authentik/FreshRSS debug helpers.

scripts/freshrss-debug-auth.php

@@ -0,0 +1,7 @@
+<?php
+header('Content-Type: text/plain');
+foreach ($_SERVER as $k => $v) {
+    if (str_starts_with($k, 'HTTP_') || str_contains($k, 'REMOTE')) {
+        echo "$k=$v\n";
+    }
+}