docs: clarify why access_control rules are required per site

default_policy: deny means no rule = 403 even for logged-in users.
Step 4 now explains the two-sided requirement: Caddy controls what
traffic reaches Authelia; the rule controls what Authelia does with it.

https://claude.ai/code/session_012eTokAaGiZo7aGt1T2W9BC

README.md

@@ -304,9 +304,16 @@ chmod 600 authelia/secrets/*
 cp .env.example .env
 $EDITOR .env    # set DOMAIN, TZ; pin image versions if you want
 
-# 4) Uncomment access_control.rules in authelia/configuration.yml for the
-#    sites you want to gate. The domain is already templated -- just
-#    uncomment the right case block and choose one_factor or two_factor.
+# 4) For each site you added `import authelia` to in Caddy, uncomment the
+#    matching rule in authelia/configuration.yml under access_control.rules.
+#
+#    WHY: default_policy is 'deny'. If a domain reaches Authelia with no
+#    matching rule, Authelia returns 403 -- even to a logged-in user. The
+#    rule tells Authelia the domain is valid and what auth level to require.
+#
+#    Each rule is two lines -- just uncomment and pick one_factor or two_factor:
+#      - domain: 'cam.{{ env "DOMAIN" }}'
+#        policy: 'two_factor'
 $EDITOR authelia/configuration.yml
 
 # 5) Create your first user.