refactor: split Caddyfile into per-host configs with shared snippets

Structure:
  shared/authentik  - forward-auth proxy + authentik snippet (both hosts)
  hosts/hubris/      - git, mcp, oikos, paperless, cloud, photos, etc.
  hosts/strong/      - media, books, roms, jellyseerr, qbit, sab, matrix, etc.

Each host imports /etc/caddy/shared/* at the top of its Caddyfile.
Systemd overrides point to hosts/<hostname>/Caddyfile.

Deploy workflow: git push → webhook → caddy reload

hosts/strong/Caddyfile

@@ -0,0 +1,83 @@
+import /etc/caddy/shared/*
+
+media.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	# SSO plugin handles auth via OIDC redirect to Authentik.
+	# No forward-auth gate — Jellyfin login page shows SSO button directly.
+	reverse_proxy 192.168.8.246:8096
+}
+
+books.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.247:6060
+}
+
+roms.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.249:80
+}
+
+jellyseerr.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.245:5056
+}
+
+qbit.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	@api path /api/*
+	handle @api {
+		reverse_proxy 192.168.8.245:8080
+	}
+	handle {
+		import authentik
+		reverse_proxy 192.168.8.245:8080
+	}
+}
+
+sab.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	handle {
+		import authentik
+		reverse_proxy 192.168.8.245:8082
+	}
+}
+
+matrix.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.242:8008
+}
+
+element.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.242:8080
+}
+
+house.hubris.network {
+tls {
+dns ionos {env.IONOS_AUTH_API_TOKEN}
+}
+reverse_proxy 192.168.8.244:3000
+}
+
+seanime.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.248:43211
+}