Add Caddy bypasses so MCP can reach *arr and Uptime Kuma through Authentik.

TB-006 forward_auth blocks machine clients with HTML/302; route /api on *arr
sites and /api plus socket.io on uptime (LAN/tailnet only) before forward_auth.
Also add Cursor interview-first rule and small Authentik/FreshRSS debug helpers.

stacks/authentik/scripts/preview-portainer-userinfo.py

@@ -0,0 +1,16 @@
+"""Print userinfo payload Portainer receives (ak shell: exec(open(...).read()))."""
+from authentik.core.models import User
+from authentik.providers.oauth2.models import OAuth2Provider, AccessToken
+from authentik.providers.oauth2.views.userinfo import UserInfoView
+from django.test import RequestFactory
+
+u = User.objects.get(username="ginnoir")
+p = OAuth2Provider.objects.get(name="portainer")
+t = AccessToken.objects.create(user=u, provider=p, scope="openid email profile")
+req = RequestFactory().get(
+    "/application/o/userinfo/",
+    HTTP_AUTHORIZATION=f"Bearer {t.token}",
+)
+resp = UserInfoView.as_view()(req)
+print("status", resp.status_code)
+print(resp.content.decode())