After batch 2 SSO, Sonarr/Radarr hitting nzbget.ginnoir.com got 302 from Caddy instead of NZBGet JSON-RPC.
Media sites get Caddy forward_auth; Authentik scripts cover all proxy providers. BookStack OIDC and Plane admin routing fixes included, plus ops scripts for external auth on valhalla.