Update authelia stack: 4 auth cases, full Caddyfile, improved docs

Keeps this as a standalone authelia+fail2ban stack (no Frigate services).

Changes:
- docker-compose.yml: fail2ban depends_on authelia with service_healthy
  condition so authelia.log exists before fail2ban tries to bind-mount it;
  add inline note about pre-creating the log file
- authelia/configuration.yml: expand access_control comment block to cover
  all 4 cases (added Case 3: app keeps own auth + Authelia as 2FA gate,
  and Case 4: app handles auth alone); clearer per-case commented rules
- caddy/Caddyfile (replaces snippet.example.caddyfile): complete Caddyfile
  with all 4 auth-case examples; (accesslog) imported in every block so
  fail2ban caddy-4xx jail covers all subdomains, not just gated ones;
  full inline docs for enabling Frigate proxy auth
- README.md: expand "Which sites" from 3 to 4 cases; add proxy-auth service
  compatibility table (Frigate, Grafana, Gitea, Nextcloud, HA, Portainer
  etc.); clarify fail2ban covers all sites via single caddy-4xx jail;
  add touch authelia/authelia.log to first-run; add troubleshooting entries
  for authelia.log bind-mount directory bug and fail2ban chain verification

https://claude.ai/code/session_012eTokAaGiZo7aGt1T2W9BC

docker-compose.yml

@@ -60,14 +60,20 @@ services:
       - F2B_DB_PURGE_AGE=7d
     volumes:
       - ./fail2ban/data:/data
-      # Authelia log -- read-only mount so fail2ban can parse 1FA/TOTP
-      # failures. Authelia writes this under /config which is ./authelia.
+      # Authelia text log -- fail2ban watches this for 1FA/TOTP failures.
+      # Authelia writes it to /config/authelia.log = ./authelia/authelia.log.
+      # IMPORTANT: `touch authelia/authelia.log` before first `docker compose up`
+      # so Docker creates it as a file, not a directory (see README.md).
       - ./authelia/authelia.log:/var/log/authelia/authelia.log:ro
-      # Caddy access log -- you must configure your Caddyfile to write
-      # JSON access logs to this host path. See README.md.
+      # Caddy JSON access log -- covers ALL sites that import (accesslog),
+      # not just Authelia-gated ones. Mount the host directory read-only.
+      # Your Caddy must write here; see README.md "Caddy access log path".
       - /var/log/caddy:/var/log/caddy:ro
+    # Wait for Authelia to pass its healthcheck before starting, so the
+    # authelia.log file exists before fail2ban tries to bind-mount it.
     depends_on:
-      - authelia
+      authelia:
+        condition: service_healthy
 
 networks:
   caddy_net: