Pin verified versions; add decision tree for Authelia coverage

- Pin AUTHELIA_VERSION=4.39.19 (current stable, released 2026-04-12) and
  FAIL2BAN_VERSION=1.1.0-r0 in .env.example + docker-compose.yml.
- Reshape access_control.rules and the Caddyfile snippet around a
  three-case decision tree: no app auth (Authelia is the gate), app with
  proxy-auth support (switch FROM app login TO Authelia headers), and
  apps that keep their own login (skip Authelia entirely).
- Document Frigate 0.14+ proxy auth specifically: auth.enabled: False,
  proxy.header_map (remote-user / remote-groups), trusted_proxies for
  the caddy_net subnet, optional X-Proxy-Secret for cross-VLAN trust.

https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3

README.md

@@ -120,16 +120,42 @@ docker compose up -d
 docker compose logs -f authelia       # expect "Authelia is listening on ..."
 ```
 
+## Which sites go behind Authelia?
+
+Authelia is opt-in per site. The goal is one login (Authelia, with 2FA)
+across everything that *can* use it -- and zero double-prompts for things
+that already authenticate themselves and can't be retrofitted.
+
+| Case | App has built-in auth? | Switchable to proxy auth? | What to do |
+|------|-----------------------|---------------------------|------------|
+| 1 | No | n/a | Gate with Authelia. Use `two_factor` for anything that controls hardware. |
+| 2 | Yes | Yes (Authelia, Authentik, oauth2_proxy headers) | Disable the app's login form, point it at Authelia headers, gate with Authelia. Single login. |
+| 3 | Yes | No | Don't involve Authelia. Plain `reverse_proxy` in Caddy. The app handles its own login. |
+
+Concretely, in this household:
+
+- **`doorbell.example.com`** (Pi PTT page) -- case 1. No app auth. Authelia
+  is the only gate. `two_factor`.
+- **`cam.example.com`** (Frigate UI) -- case 2. Frigate 0.14+ supports
+  proxy auth, so disable Frigate's login form and let Authelia drive both
+  the auth and the role mapping. Single login covers Frigate too.
+- **router admin / NAS UI / odd one-offs** -- case 3 territory. Plain
+  `reverse_proxy`, no `import authelia`, no Authelia rule.
+
+Default policy in `configuration.yml` is `deny`, so a domain with no rule
+*and* no `import authelia` in Caddy never reaches Authelia at all -- the
+deny doesn't apply.
+
 ## Wire Caddy into Authelia
 
 Open `caddy/snippet.example.caddyfile`. It defines:
 
-- `(authelia)` -- a reusable snippet: `import authelia` in any site block to
-  gate it.
+- `(authelia)` -- reusable snippet: `import authelia` in any site block
+  you want gated.
 - `(accesslog)` -- writes Caddy's JSON access log to `/var/log/caddy/access.log`
   so fail2ban can watch it.
 - `auth.example.com` -- the Authelia portal subdomain.
-- Example protected blocks for `cam.example.com` and `doorbell.example.com`.
+- Example blocks for the three cases above.
 
 Copy the relevant blocks into your real Caddyfile, replace `example.com`
 with your domain and `192.168.x.x` with real upstream IPs, then reload Caddy:
@@ -139,14 +165,45 @@ docker compose -f ~/docker/caddy/docker-compose.yml exec caddy \
     caddy reload --config /etc/caddy/Caddyfile
 ```
 
-For each protected domain, also add a rule under `access_control.rules` in
-`authelia/configuration.yml` (Authelia's default policy is `deny` -- a
-domain with no rule will not authenticate). Restart Authelia after editing:
+For each case-1 or case-2 domain, also add a rule under `access_control.rules`
+in `authelia/configuration.yml`. Restart Authelia after editing:
 
 ```bash
 docker compose restart authelia
 ```
 
+### Switching Frigate to Authelia (case 2)
+
+Frigate 0.14+ has a `proxy:` config block that consumes a username header
+from the upstream and skips its own login form. Edit
+`frigate_config/config.yml` in your Frigate repo:
+
+```yaml
+auth:
+  enabled: False
+  trusted_proxies:
+    - 172.18.0.0/16          # the caddy_net subnet -- find it with:
+                             #   docker network inspect caddy_net | jq '.[0].IPAM.Config'
+
+proxy:
+  header_map:
+    user: remote-user        # what Authelia sends; matches `copy_headers` in Caddy
+    role: remote-groups
+  default_role: viewer
+  separator: '|'
+  # Optional but recommended when Caddy crosses VLANs to reach Frigate.
+  # Generate with `openssl rand -hex 32`. Caddy must send the same value
+  # as `X-Proxy-Secret` -- see the cam.* block in caddy/snippet.example.caddyfile.
+  # auth_secret: 'paste-32-byte-hex-here'
+```
+
+Restart Frigate (`docker compose restart frigate` in the Frigate repo).
+Confirm the Frigate UI now jumps straight to Authelia and back without
+a Frigate login screen.
+
+If you want Authelia groups to drive Frigate roles (admin vs. viewer),
+add a `role_map:` under `proxy:` (see Frigate docs).
+
 ### Caddy access log path
 
 fail2ban mounts `/var/log/caddy` from the host as read-only. Your Caddy