Gate artifacto admin with Authentik + forward gateway header

Inject X-Artifacto-Gateway (shared secret in ARTIFACTO_GATEWAY_SECRET)
so the app can auto-login Authentik-authenticated users while
rejecting spoofed SSO headers from direct-connection peers.

Leaves /p/* (share URLs), /static/*, /healthz public.

Caddyfile

@@ -161,5 +161,17 @@ artifacto.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.205:3100
+	# Public paths: share URLs, static assets, health — no SSO
+	@public path /p/* /static/* /healthz
+	handle @public {
+		reverse_proxy 192.168.8.205:3100
+	}
+	# Admin + login surface: Authentik forward-auth + shared-secret header
+	# so the app can auto-login an Authentik-authenticated user.
+	handle {
+		import authentik
+		reverse_proxy 192.168.8.205:3100 {
+			header_up X-Artifacto-Gateway {env.ARTIFACTO_GATEWAY_SECRET}
+		}
+	}
 }