docs: update Authelia setup instructions to use MERGE workflow

- Step 3 now says MERGE (not replace/append) with clear warning to keep existing config
- access_control: kiosk one_factor rule must go ABOVE any existing two_factor rule,
  with explanation that Authelia applies rules top-down (first match wins)
- session block: keep existing values; only add the block if none exists yet
- Kiosk can only do one_factor — TOTP/WebAuthn via API is not possible
- Updated in both configure_authelia() printed output and README Authentication section

https://claude.ai/code/session_01EyjEQLWbTXcZgbMDarf7NU

Readme.md

@@ -156,25 +156,35 @@ kiosk:
     - kiosk
 ```
 
-**Step 3 — Configure session duration and access control** in `~/docker/authelia/config/configuration.yml`:
+**Step 3 — MERGE into `~/docker/authelia/config/configuration.yml`** (do not replace your existing config):
+
+**access_control** — Add the kiosk rule **ABOVE** any existing `two_factor` rule. Authelia applies rules top-down — first match wins:
 
 ```yaml
-session:
-  expiration: 1y       # absolute session lifetime
-  inactivity: 90d      # idle timeout before logout
-  remember_me: 1y      # duration granted by keepMeLoggedIn
-
 access_control:
   default_policy: deny
   rules:
-    # Allow kiosk group to reach any subdomain with one-factor auth
+    # ADD THIS — kiosk can only do one_factor (no TOTP/WebAuthn via API)
     - domain: '*.yourdomain.com'
       subject: 'group:kiosk'
       policy: one_factor
-    # Optional: bypass Authelia entirely for the kiosk's static IP
+    # Keep your existing rules below — e.g.:
     # - domain: '*.yourdomain.com'
-    #   networks: ['192.168.1.50/32']
-    #   policy: bypass
+    #   policy: two_factor
+```
+
+**session** — Keep your existing session block as-is; no changes needed. The kiosk re-authenticates via API on every startup so session expiry barely matters for it.
+
+If you do **not** yet have a session block, add:
+
+```yaml
+session:
+  expiration: 8h
+  inactivity: 1h
+  remember_me: 7d
+  cookies:
+    - domain: yourdomain.com
+      authelia_url: https://auth.yourdomain.com
 ```
 
 **Step 4 — Restart Authelia:**

ubuntu-based-kiosk-v1.0.2.sh

@@ -10039,7 +10039,8 @@ process.stdout.write(Buffer.concat([iv,enc]).toString('base64'));
     echo
     echo "   Copy the \$argon2id\$... output — that is your hash."
     echo
-    echo "2. Add a kiosk user to ~/docker/authelia/config/users.yml:"
+    echo "2. ADD a kiosk user to ~/docker/authelia/config/users.yml"
+    echo "   (append — do not replace existing users):"
     echo
     echo "   kiosk:"
     echo "     displayname: \"Kiosk Display\""
@@ -10048,19 +10049,37 @@ process.stdout.write(Buffer.concat([iv,enc]).toString('base64'));
     echo "     groups:"
     echo "       - kiosk"
     echo
-    echo "3. Add to ~/docker/authelia/config/configuration.yml:"
+    echo "3. MERGE into ~/docker/authelia/config/configuration.yml:"
     echo
-    echo "   session:"
-    echo "     expiration: 1y"
-    echo "     inactivity: 90d"
-    echo "     remember_me: 1y"
+    echo "   ── access_control ─────────────────────────────────────"
+    echo "   Add the kiosk rule ABOVE any existing two_factor rule."
+    echo "   Authelia applies rules top-down — first match wins."
     echo
     echo "   access_control:"
     echo "     default_policy: deny"
     echo "     rules:"
+    echo "       # ADD THIS — kiosk can only do one_factor (no TOTP/WebAuthn via API)"
     echo "       - domain: '*.yourdomain.com'"
     echo "         subject: 'group:kiosk'"
     echo "         policy: one_factor"
+    echo "       # Keep your existing rules below — e.g.:"
+    echo "       # - domain: '*.yourdomain.com'"
+    echo "       #   policy: two_factor"
+    echo
+    echo "   ── session ─────────────────────────────────────────────"
+    echo "   Keep your existing session block — no changes needed."
+    echo "   The kiosk re-authenticates via API on every startup so"
+    echo "   session expiry barely matters for it."
+    echo
+    echo "   If you do NOT yet have a session block, add:"
+    echo
+    echo "   session:"
+    echo "     expiration: 8h"
+    echo "     inactivity: 1h"
+    echo "     remember_me: 7d"
+    echo "     cookies:"
+    echo "       - domain: yourdomain.com"
+    echo "         authelia_url: https://auth.yourdomain.com"
     echo
     echo "4. Restart Authelia on your Docker host:"
     echo "   docker compose restart authelia"