Fix Plex/Emby Authelia caveat: Case 4, not Case 3

Native clients (mobile, TV, desktop) DO route through Caddy via FQDN,
but cannot complete Authelia's browser-redirect login flow -- they get a
302 to auth.DOMAIN and fail. `import authelia` breaks all native clients.

Correct setup is Case 4: Caddy terminates TLS, import accesslog for
fail2ban, NO import authelia. Plex/Emby token auth handles access control.

https://claude.ai/code/session_012eTokAaGiZo7aGt1T2W9BC

caddy/snippets.caddyfile

@@ -344,23 +344,28 @@ portainer.{env.DOMAIN} {
 # }
 
 # --- Plex ---
-# IMPORTANT: Plex is tightly coupled to plex.tv cloud auth -- Authelia cannot
-# replace it. This gate applies to the web UI only. Plex clients (mobile, TV,
-# desktop apps) communicate directly with the server port and bypass Caddy
-# entirely, so the gate does not protect those paths. Tailscale or VPN is
-# the better approach for Plex remote access.
+# DO NOT use `import authelia` with Plex/Emby. Plex is coupled to plex.tv
+# cloud auth -- Authelia cannot replace it. More importantly, native clients
+# (mobile, TV, desktop apps) connect via FQDN through Caddy but CANNOT
+# complete Authelia's browser-redirect login flow (no cookie, no TOTP prompt).
+# `import authelia` will break all native clients with a connection error.
+#
+# Correct approach: Case 4. Caddy terminates TLS and reverse proxies; Plex's
+# own token auth handles access control. `import accesslog` keeps fail2ban
+# watching the subdomain for scanners.
+#
 # plex.{env.DOMAIN} {
 #     import accesslog
-#     import authelia
-#     reverse_proxy 192.168.x.x:32400              # CHANGE IP
+#     reverse_proxy 192.168.x.x:32400              # CHANGE IP -- NO import authelia
 # }
 
 # --- Emby ---
-# Same caveat as Plex: Emby clients bypass Caddy. Web UI gate only.
+# Same situation as Plex: native clients go through Caddy but cannot handle
+# Authelia's login redirect. Use Case 4 -- Caddy + TLS, Emby's own auth.
+#
 # emby.{env.DOMAIN} {
 #     import accesslog
-#     import authelia
-#     reverse_proxy 192.168.x.x:8096               # CHANGE IP
+#     reverse_proxy 192.168.x.x:8096               # CHANGE IP -- NO import authelia
 # }
 
 # --- Gotify ---