refactor: split Caddyfile into per-host configs with shared snippets

Structure:
  shared/authentik  - forward-auth proxy + authentik snippet (both hosts)
  hosts/hubris/      - git, mcp, oikos, paperless, cloud, photos, etc.
  hosts/strong/      - media, books, roms, jellyseerr, qbit, sab, matrix, etc.

Each host imports /etc/caddy/shared/* at the top of its Caddyfile.
Systemd overrides point to hosts/<hostname>/Caddyfile.

Deploy workflow: git push → webhook → caddy reload

shared/authentik

@@ -0,0 +1,34 @@
+# Internal forward-auth upstream proxy (no TLS between Caddy handlers)
+:8099 {
+	@outpost path /outpost.goauthentik.io/*
+	reverse_proxy @outpost https://auth.hubris.network:443 {
+		transport http {
+			tls_server_name auth.hubris.network
+		}
+		header_up Host auth.hubris.network
+	}
+}
+
+# Authentik forward-auth snippet (domain-level mode).
+# Usage: add "import authentik" inside any site block to gate it.
+(authentik) {
+	route {
+		reverse_proxy /outpost.goauthentik.io/* https://auth.hubris.network:443
+		forward_auth http://127.0.0.1:8099 {
+			uri /outpost.goauthentik.io/auth/caddy
+			copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
+			trusted_proxies private_ranges
+			header_up X-Forwarded-Host {host}
+			header_up X-Forwarded-Proto {scheme}
+			header_up X-Forwarded-Uri {uri}
+		}
+	}
+}
+
+# Unless the file starts with a global options block, the first
+# uncommented line is always the address of your site.
+#
+# To use your own domain name (with automatic HTTPS), first make
+# sure your domain's A/AAAA DNS records are properly pointed to
+# this machine's public IP, then replace ":80" below with your
+# domain name.