Fix Plex/Emby Authelia caveat: Case 4, not Case 3

Native clients (mobile, TV, desktop) DO route through Caddy via FQDN,
but cannot complete Authelia's browser-redirect login flow -- they get a
302 to auth.DOMAIN and fail. `import authelia` breaks all native clients.

Correct setup is Case 4: Caddy terminates TLS, import accesslog for
fail2ban, NO import authelia. Plex/Emby token auth handles access control.

https://claude.ai/code/session_012eTokAaGiZo7aGt1T2W9BC

README.md

@@ -184,8 +184,8 @@ upstream", "trusted proxies", "header-based auth", "SSO via reverse proxy".
 | **App keeps own auth (case 3)** | | |
 | Uptime Kuma | 3 | No proxy auth, no native TOTP -- Authelia is the only way to add 2FA |
 | qBittorrent | 3 | Web UI has own auth; no proxy headers |
-| Plex | 3 ⚠ | Web UI gate only -- Plex clients bypass Caddy entirely; VPN is better |
+| Plex | 4 ⚠ | Do NOT use `import authelia` -- native clients go through Caddy but cannot complete browser-redirect auth; use Case 4, Plex handles its own auth |
-| Emby | 3 ⚠ | Same caveat as Plex; clients bypass Caddy |
+| Emby | 4 ⚠ | Same as Plex |
 | Gotify | 3 | Notification server; own auth |
 | ntfy | 3 | Notification server; token-based auth |
 | wg-easy | 3 | WireGuard web UI; WireGuard clients bypass Caddy (UDP 51820) |

caddy/snippets.caddyfile

@@ -344,23 +344,28 @@ portainer.{env.DOMAIN} {
 # }
 
 # --- Plex ---
-# IMPORTANT: Plex is tightly coupled to plex.tv cloud auth -- Authelia cannot
+# DO NOT use `import authelia` with Plex/Emby. Plex is coupled to plex.tv
-# replace it. This gate applies to the web UI only. Plex clients (mobile, TV,
+# cloud auth -- Authelia cannot replace it. More importantly, native clients
-# desktop apps) communicate directly with the server port and bypass Caddy
+# (mobile, TV, desktop apps) connect via FQDN through Caddy but CANNOT
-# entirely, so the gate does not protect those paths. Tailscale or VPN is
+# complete Authelia's browser-redirect login flow (no cookie, no TOTP prompt).
-# the better approach for Plex remote access.
+# `import authelia` will break all native clients with a connection error.
+#
+# Correct approach: Case 4. Caddy terminates TLS and reverse proxies; Plex's
+# own token auth handles access control. `import accesslog` keeps fail2ban
+# watching the subdomain for scanners.
+#
 # plex.{env.DOMAIN} {
 #     import accesslog
-#     import authelia
+#     reverse_proxy 192.168.x.x:32400              # CHANGE IP -- NO import authelia
-#     reverse_proxy 192.168.x.x:32400              # CHANGE IP
 # }
 
 # --- Emby ---
-# Same caveat as Plex: Emby clients bypass Caddy. Web UI gate only.
+# Same situation as Plex: native clients go through Caddy but cannot handle
+# Authelia's login redirect. Use Case 4 -- Caddy + TLS, Emby's own auth.
+#
 # emby.{env.DOMAIN} {
 #     import accesslog
-#     import authelia
+#     reverse_proxy 192.168.x.x:8096               # CHANGE IP -- NO import authelia
-#     reverse_proxy 192.168.x.x:8096               # CHANGE IP
 # }
 
 # --- Gotify ---