Support remote Authelia and remote/central CrowdSec LAPI

Both let the DO droplet lean on services already running on a
homelab instead of duplicating them locally, per the RAM-budget
discussion (Authelia+Redis and a second CrowdSec LAPI+DB add up).

crowdsec.sh: new step lets this agent register against a remote LAPI
(cscli lapi register -u <url>) and disables its own local API server
by removing the api.server block from config.yaml (backed up first;
verified the exact block boundaries against CrowdSec's actual default
config.yaml from upstream before writing the awk removal). Parsers,
scenarios, and the firewall bouncer still run locally regardless —
only banning decisions centralize, and only after the registration is
approved with `cscli machines validate` on the central machine, which
this script can't do since that's a different box. The final restart
step is skipped with an explanation when registration is pending,
instead of showing a misleading "failed to restart" for an expected
state.

asterisk-do.sh: when no local Authelia is installed, the web-admin
Caddy step now offers a remote Authelia option instead, building the
same forward_auth block inline (authelia.sh's shared Caddy snippet
only exists for local installs) targeting either a bare host:port
(e.g. a NetBird mesh IP) or a full https:// URL. Documents that this
couples web-admin availability to the remote instance's reachability,
while SIP/calling on the droplet stays unaffected either way.

Both changes verified: the config.yaml block-removal awk logic tested
against CrowdSec's real upstream default file structure, the remote
Authelia forward_auth block construction tested in isolation, and
full regression runs confirm the default (declined) path through both
new prompts is unchanged.

services/asterisk-do.sh

@@ -214,6 +214,7 @@ install_asterisk-do() {
         echo "[DRY-RUN] Would open 51820/udp (not 51821) if wg-easy was selected"
         echo "[DRY-RUN] Would offer to create a DigitalOcean Cloud Firewall via doctl"
         echo "[DRY-RUN] Would reverse-proxy the web admin on the SAME FQDN used for SIP (needed for cert sync)"
+        echo "[DRY-RUN] Would offer local OR remote Authelia to protect the web admin"
         echo "[DRY-RUN] Would offer to install CrowdSec if not already present (full repo only)"
         return 0
     fi
@@ -580,6 +581,31 @@ ENV
                 # Disable built-in auth since Authelia handles it
                 sed -i "s/^WEB_ADMIN_AUTH_DISABLED=.*/WEB_ADMIN_AUTH_DISABLED=true/" .env
             fi
+        else
+            # No local Authelia — offer one running elsewhere (e.g. a homelab).
+            # There's no shared "(authelia)" Caddy snippet to import in that
+            # case (authelia.sh only writes one when installing locally), so
+            # this builds the same forward_auth block inline, targeting the
+            # remote instance directly instead of the local "authelia:9091"
+            # container reference.
+            local _use_remote_auth=""
+            prompt_yn "Protect the web admin with a remote Authelia instance (e.g. on a homelab)? (y/n):" "n" _use_remote_auth
+            if [[ "$_use_remote_auth" =~ ^[Yy]$ ]]; then
+                local _remote_authelia=""
+                prompt_text "  Remote Authelia address — a bare host:port over a private network (e.g. a NetBird mesh IP:9091), or a full https:// URL if it's on its own public domain+TLS:" "" _remote_authelia
+                if [[ -n "$_remote_authelia" ]]; then
+                    EXTRA_BLOCK="    forward_auth ${_remote_authelia} {
+        uri /api/authz/forward-auth
+        copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
+    }"
+                    sed -i "s/^WEB_ADMIN_AUTH_DISABLED=.*/WEB_ADMIN_AUTH_DISABLED=true/" .env
+                    log_info "Using remote Authelia at ${_remote_authelia}."
+                    log_info "Verify it's reachable from this droplet before relying on it — e.g.:"
+                    log_info "  curl -I ${_remote_authelia}"
+                else
+                    log_info "No address entered — skipping Authelia protection."
+                fi
+            fi
         fi
 
         # Reconstruct the subdomain-only fragment so configure_caddy_for_service's
@@ -740,9 +766,16 @@ plan for the admin panel.
 Offered during install (space-separated at the "Install:" prompt); can also
 be added later by running \`sudo ./setup.sh <name>\` from the repo.
 
-- **authelia** — SSO/2FA in front of the web admin. Needs Caddy. Once
-  installed, re-running \`asterisk-do\` will offer to protect the web admin
-  with it.
+- **authelia** — SSO/2FA in front of the web admin. Needs Caddy locally to
+  install here. If it's already installed (locally or picked up by
+  re-running \`asterisk-do\`), that instance protects the web admin
+  automatically. **No local Authelia?** The web-admin step separately offers
+  a **remote Authelia** option instead — point it at an instance already
+  running elsewhere (e.g. a homelab) via a bare \`host:port\` over a private
+  network (a NetBird mesh IP works well here) or a full \`https://\` URL if
+  it has its own public domain+TLS. Every web-admin page load then does a
+  round trip to that address, so if it's unreachable, the panel fails closed
+  — SIP/calling on this droplet is unaffected either way, only the admin UI.
 - **ntfy** — self-hosted push notifications. Useful as a destination for
   CrowdSec ban alerts (\`services/crowdsec.sh\` prompts for an ntfy URL —
   point it at this instance instead of the public ntfy.sh if you'd rather