Pin verified versions; add decision tree for Authelia coverage

- Pin AUTHELIA_VERSION=4.39.19 (current stable, released 2026-04-12) and
  FAIL2BAN_VERSION=1.1.0-r0 in .env.example + docker-compose.yml.
- Reshape access_control.rules and the Caddyfile snippet around a
  three-case decision tree: no app auth (Authelia is the gate), app with
  proxy-auth support (switch FROM app login TO Authelia headers), and
  apps that keep their own login (skip Authelia entirely).
- Document Frigate 0.14+ proxy auth specifically: auth.enabled: False,
  proxy.header_map (remote-user / remote-groups), trusted_proxies for
  the caddy_net subnet, optional X-Proxy-Secret for cross-VLAN trust.

https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3

docker-compose.yml

@@ -21,7 +21,7 @@ services:
 
   authelia:
     container_name: authelia
-    image: authelia/authelia:${AUTHELIA_VERSION:-4.39}
+    image: authelia/authelia:${AUTHELIA_VERSION:-4.39.19}
     restart: unless-stopped
     networks:
       - caddy_net
@@ -46,7 +46,7 @@ services:
 
   fail2ban:
     container_name: fail2ban
-    image: crazymax/fail2ban:${FAIL2BAN_VERSION:-latest}
+    image: crazymax/fail2ban:${FAIL2BAN_VERSION:-1.1.0-r0}
     restart: unless-stopped
     # Host networking so iptables bans take effect on the host's edge,
     # including DOCKER-USER chain rules that gate traffic to containers.