v0.9.6: README generation + migrate authelia + 5 services

- lib/common.sh: add write_readme helper. Every module now writes a README.md
  into its ~/docker/<service>/ folder (self-documenting service folders).
- services/authelia.sh: SSO + 2FA portal, ported from the authelia-setup repo +
  the monolith's working block (secrets + Argon2 hash generation, caddy_net,
  Caddyfile forward-auth snippet + portal block, README). Guards against
  clobbering an existing install.
- services/{filebrowser,ntfy,uptimekuma,portainer,watchtower}.sh: mechanical
  migrations from the monolith, each with a README. Ports 8085/8090/3001/9443/—.

All pass bash -n; ./setup.sh --list shows them under homelab; dry-run run-one
exits 0 for each with real commands guarded.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to this project. Versions follow `MAJOR.MINOR.PATCH`.
 The project is pre-1.0 while the modular system reaches parity with the
 monolithic `ubuntu-post-install-*.sh` scripts.
 
+## [0.9.6] - 2026-06-03
+
+### Added
+- **Per-service README generation.** New `write_readme` helper in
+  `lib/common.sh`; every module now writes a `README.md` into its
+  `~/docker/<service>/` folder (what it is, access URL, start/stop, data
+  location, reverse-proxy notes) — so each service folder is self-documenting.
+- Migrated 6 services from the monolith into modules (all in the `homelab`
+  group, each with a README):
+  - `authelia` — SSO + 2FA portal, ported from the `authelia-setup` repo + the
+    monolith's working block: prompts for domain/SMTP, generates
+    jwt/session/storage secrets + the admin Argon2 hash, writes
+    compose/config/users, creates `caddy_net`, and injects the forward-auth
+    snippet + portal block into the Caddyfile. Won't clobber an existing install.
+  - `filebrowser` (8085), `ntfy` (8090), `uptimekuma` (3001),
+    `portainer` (9443), `watchtower` (no web port).
+
+### Notes
+- `homelab` group now: authelia, filebrowser, homeassistant, ntfy, portainer,
+  uptimekuma, watchtower.
+- Remaining monolith services still to migrate: ActualBudget, ARM,
+  AudioBookshelf, Caddy, CrowdSec, Emby, FindMyDevice, Frigate, Frigate-Notify,
+  Immich, Jellyfin, Lyrion, MagicMirror, Mealie, MeshCentral, Traccar, ddclient,
+  wg-easy.
+
 ## [0.9.5] - 2026-06-03
 
 ### Added