docs: sab.hubris.network Authentik auth — update arriman + caddy pages

containers/121-caddy.md

@@ -28,7 +28,7 @@ The reverse proxy. Terminates TLS for every `*.hubris.network` hostname on the L
 - `photos.hubris.network` → [mule-images (120)](120-mule-images.md) `:3000`
 - `proxmox.hubris.network` → [hubris host](../hosts/hubris.md) `:8006`
 - `qbit.hubris.network` → [arriman (122)](122-arriman.md) `:8080`
-- `sab.hubris.network` → [arriman (122)](122-arriman.md) `:8081`
+- `sab.hubris.network` → [arriman (122)](122-arriman.md) `:8082` (Authentik forward-auth)
 
 > **Reminder:** Caddy alone isn't enough to make a new subdomain reachable on the LAN. Each one needs an entry in [DNS split-horizon](../infrastructure/dns.md) too.
 
@@ -65,6 +65,9 @@ Gitea webhook id 2 on `dtoro/caddy-conf`. Receiver, deploy script, install scrip
 
 ## Changelog
 
+### 2026-06-13 — sab.hubris.network gated with Authentik forward-auth; port fixed :8081→:8082
+`sab.hubris.network` now uses `import authentik` inside a `handle` block. SABnzbd own auth disabled, `local_ranges` set for transparent proxy. Port bumped from `:8081` to `:8082` (fix from 2026-06-04) now documented.
+
 ### 2026-06-06 — Caddyfile truncated to 43 lines; restored from origin/master + safeguards added
 **Symptom:** All `*.hubris.network` hosts except `photos` and `auth` (VPS-hosted) returned `tlsv1 alert internal error` or timeout. Only 3 site blocks (`photos`, `prism`, `photos2`) remained in the Caddyfile.