v0.9.6: README generation + migrate authelia + 5 services

- lib/common.sh: add write_readme helper. Every module now writes a README.md
  into its ~/docker/<service>/ folder (self-documenting service folders).
- services/authelia.sh: SSO + 2FA portal, ported from the authelia-setup repo +
  the monolith's working block (secrets + Argon2 hash generation, caddy_net,
  Caddyfile forward-auth snippet + portal block, README). Guards against
  clobbering an existing install.
- services/{filebrowser,ntfy,uptimekuma,portainer,watchtower}.sh: mechanical
  migrations from the monolith, each with a README. Ports 8085/8090/3001/9443/—.

All pass bash -n; ./setup.sh --list shows them under homelab; dry-run run-one
exits 0 for each with real commands guarded.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

lib/common.sh

@@ -121,6 +121,26 @@ prompt_text() {
     eval "$varname='${response:-$default}'"
 }
 
+# ── Per-service README generation ────────────────────────────────────────────
+# Write <dir>/README.md from stdin (markdown). Every module is encouraged to
+# call this so each ~/docker/<service>/ folder is self-documenting.
+# Usage:
+#   write_readme "$DIR" <<MD
+#   # Title
+#   ...
+#   MD
+write_readme() {
+    local dir="$1"
+    if [ "$DRY_RUN" = true ]; then
+        cat >/dev/null            # consume the heredoc so the caller isn't blocked
+        echo "[DRY-RUN] Would write $dir/README.md"
+        return 0
+    fi
+    mkdir -p "$dir"
+    cat > "$dir/README.md"
+    chown "$ACTUAL_USER:$ACTUAL_USER" "$dir/README.md" 2>/dev/null || true
+}
+
 # ── Caddy reverse-proxy wiring (shared by every web service) ─────────────────
 # Usage: configure_caddy_for_service "Name" "PORT" "default-subdomain" ["extra"]
 configure_caddy_for_service() {