oikos: split SPA off to its own :8091 container

api no longer embeds the SPA (it's compose/web/Dockerfile's `web`
service in the oikos repo now) — route the catch-all handle to :8091
instead of :8090, and restore the /api/v1/*, /mcp, /agent/* matcher so
those keep hitting api directly rather than falling through to the
static file server.

Caddyfile

@@ -1,9 +1,20 @@
+# Internal forward-auth upstream proxy (no TLS between Caddy handlers)
+:8099 {
+	@outpost path /outpost.goauthentik.io/*
+	reverse_proxy @outpost https://auth.hubris.network:443 {
+		transport http {
+			tls_server_name auth.hubris.network
+		}
+		header_up Host auth.hubris.network
+	}
+}
+
 # Authentik forward-auth snippet (domain-level mode).
 # Usage: add "import authentik" inside any site block to gate it.
 (authentik) {
 	route {
-		reverse_proxy /outpost.goauthentik.io/* http://192.168.8.180:9000
-		forward_auth http://192.168.8.180:9000 {
+		reverse_proxy /outpost.goauthentik.io/* https://auth.hubris.network:443
+		forward_auth http://127.0.0.1:8099 {
 			uri /outpost.goauthentik.io/auth/caddy
 			copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
 			trusted_proxies private_ranges
@@ -28,7 +39,9 @@ media.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.206:8096
+	# SSO plugin handles auth via OIDC redirect to Authentik.
+	# No forward-auth gate — Jellyfin login page shows SSO button directly.
+	reverse_proxy 192.168.8.246:8096
 }
 
 git.hubris.network {
@@ -62,7 +75,14 @@ books.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.205:6060
+	reverse_proxy 192.168.8.247:6060
+}
+
+roms.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.249:80
 }
 
 home.hubris.network {
@@ -79,12 +99,6 @@ cloud.hubris.network {
 	reverse_proxy 192.168.8.224:80
 }
 
-matrix.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	reverse_proxy 192.168.8.239:8008
-}
 
 proxmox.hubris.network {
 	tls {
@@ -112,7 +126,7 @@ jellyseerr.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.132:5056
+	reverse_proxy 192.168.8.245:5056
 }
 
 qbit.hubris.network {
@@ -121,11 +135,11 @@ qbit.hubris.network {
 	}
 	@api path /api/*
 	handle @api {
-		reverse_proxy 192.168.8.132:8080
+		reverse_proxy 192.168.8.245:8080
 	}
 	handle {
 		import authentik
-		reverse_proxy 192.168.8.132:8080
+		reverse_proxy 192.168.8.245:8080
 	}
 }
 
@@ -133,7 +147,10 @@ sab.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.132:8081
+	handle {
+		import authentik
+		reverse_proxy 192.168.8.245:8082
+	}
 }
 
 blog.hubris.network {
@@ -144,30 +161,44 @@ blog.hubris.network {
 }
 
 photos.hubris.network {
-	# mule-image — PhotoPrism + Go sidecar + SvelteKit (post-Mulimage 2.0)
+	# Mulimage 2.0 — PhotoPrism + Go sidecar + SvelteKit (LXC 120)
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
 	encode zstd gzip
-	# PhotoPrism API + OIDC callback first (matched before static catch-all)
+	# PhotoPrism API + static assets + share links
 	@pp path /api/v1/* /api/v1 /static/* /share/*
 	reverse_proxy @pp 192.168.8.136:2342
-	# PhotoPrism redirects to /library/browse after OIDC. Bounce back to
-	# the SvelteKit SPA; mule-image is the only user-facing frontend.
+	# OIDC hand-off: PhotoPrism redirects to /library/login after SSO;
+	# bounce back to / so the SvelteKit SPA picks up the session.
 	redir /library / 302
 	redir /library/* / 302
-	# mule-sidecar (Go) — keeps the /api/sidecar/ prefix
+	# Go sidecar — marks, folder mutations, duplicates, heap convert
 	@sc path /api/sidecar/*
 	reverse_proxy @sc 192.168.8.136:8000
-	# Catch-all → nginx-on-120 serving the SvelteKit static bundle (no Vite in prod)
+	# SvelteKit frontend (catch-all)
 	reverse_proxy 192.168.8.136:3000
 }
 
+prism.hubris.network {
+	# PhotoPrism — direct access for Prismatic mobile client (LXC 120)
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	encode zstd gzip
+	reverse_proxy 192.168.8.136:2342
+}
+
 auth.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.180:9000
+	reverse_proxy https://auth.hubris.network:443 {
+		transport http {
+			tls_server_name auth.hubris.network
+		}
+		header_up Host auth.hubris.network
+	}
 }
 
 artifacto.hubris.network {
@@ -205,18 +236,85 @@ zimaos.hubris.network {
 
 # Homelab MCP server (read-only context + management tools).
 # Mesh+LAN-gated by the service itself + nftables; no SSO so agent clients work.
-mcp.hubris.network {
+sso.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.205:9810
+	reverse_proxy https://auth.hubris.network:443 {
+		transport http {
+			tls_server_name auth.hubris.network
+		}
+		header_up Host auth.hubris.network
+	}
 }
 
-# Per-client age-key issuance (mesh-only via source-IP gating in the service).
-# No SSO — agents call this during bootstrap; identity is mesh peer + hostname.
-secrets.hubris.network {
+
+element.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.205:9820
+	reverse_proxy 192.168.8.242:8080
+}
+
+trmnl.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.211:9851
+}
+
+house.hubris.network {
+tls {
+dns ionos {env.IONOS_AUTH_API_TOKEN}
+}
+reverse_proxy 192.168.8.244:3000
+}
+
+teddy.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy https://192.168.8.150:8443 {
+		transport http {
+			tls_insecure_skip_verify
+		}
+	}
+}
+
+seanime.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.248:43211
+}
+
+# ─── Oikos (Go rewrite, Docker on mac-mini) ───
+# Phase 6 cutover — replaces apps/105 Python MCP + console.
+# /api/v1/clients/enroll bypasses Authentik (IP-gated in the API handler).
+# The SPA is its own container (:8091, compose/web/Dockerfile in the oikos
+# repo) — not served by api itself, which no longer embeds it.
+oikos.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	@enroll path /api/v1/clients/enroll
+	handle @enroll {
+		reverse_proxy 192.168.178.182:8090
+	}
+	@api path /api/v1/* /mcp /agent/*
+	handle @api {
+		reverse_proxy 192.168.178.182:8090
+	}
+	handle {
+		import authentik
+		reverse_proxy 192.168.178.182:8091
+	}
+}
+
+mcp.hubris.network {
+	reverse_proxy 192.168.178.182:8090
+}
+
+hermes.hubris.network {
+	reverse_proxy 192.168.178.182:8092
 }