v0.9.6: README generation + migrate authelia + 5 services

- lib/common.sh: add write_readme helper. Every module now writes a README.md
  into its ~/docker/<service>/ folder (self-documenting service folders).
- services/authelia.sh: SSO + 2FA portal, ported from the authelia-setup repo +
  the monolith's working block (secrets + Argon2 hash generation, caddy_net,
  Caddyfile forward-auth snippet + portal block, README). Guards against
  clobbering an existing install.
- services/{filebrowser,ntfy,uptimekuma,portainer,watchtower}.sh: mechanical
  migrations from the monolith, each with a README. Ports 8085/8090/3001/9443/—.

All pass bash -n; ./setup.sh --list shows them under homelab; dry-run run-one
exits 0 for each with real commands guarded.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

services/filebrowser.sh

@@ -0,0 +1,99 @@
+#!/bin/bash
+# services/filebrowser.sh — FileBrowser web-based file manager.
+# Part of the modular post-install system (sourced by setup.sh).
+
+register_service filebrowser homelab "Web file manager (FileBrowser)" 8085
+
+install_filebrowser() {
+    require_docker || return 1
+    log_info "Installing Filebrowser..."
+    local FB_DIR="$DOCKER_DIR/filebrowser"
+
+    if [ "$DRY_RUN" = true ]; then
+        echo "[DRY-RUN] Would create $FB_DIR"
+        return 0
+    fi
+
+    mkdir -p "$FB_DIR"
+    ensure_docker_dir_ownership "$FB_DIR"
+    cd "$FB_DIR" || return 1
+
+    local FB_PATH=""
+    prompt_text "Path to browse [default: $ACTUAL_HOME]:" "$ACTUAL_HOME" FB_PATH
+
+    cat > docker-compose.yml << FB_COMPOSE
+name: filebrowser
+
+services:
+  filebrowser:
+    image: filebrowser/filebrowser:s6
+    container_name: filebrowser
+    hostname: filebrowser
+    restart: unless-stopped
+    environment:
+      - PUID=$(id -u "$ACTUAL_USER")
+      - PGID=$(id -g "$ACTUAL_USER")
+      - TZ=$(cat /etc/timezone 2>/dev/null || echo "UTC")
+    volumes:
+      - ${FB_PATH}:/srv
+      - ./database/filebrowser.db:/database/filebrowser.db
+      - ./config/settings.json:/config/settings.json
+    ports:
+      - "8085:80"
+FB_COMPOSE
+
+    cat > .env << FB_ENV
+FB_PATH=$FB_PATH
+FB_ENV
+
+    mkdir -p database config
+    touch database/filebrowser.db
+    cat > config/settings.json << 'FB_SETTINGS'
+{
+  "port": 80,
+  "baseURL": "",
+  "address": "",
+  "log": "stdout",
+  "database": "/database/filebrowser.db",
+  "root": "/srv"
+}
+FB_SETTINGS
+
+    chown -R "$ACTUAL_USER:$ACTUAL_USER" "$FB_DIR"
+
+    echo ""
+    log_success "Filebrowser configured at $FB_DIR"
+
+    write_readme "$FB_DIR" << MD
+# FileBrowser
+
+Web-based file manager. Browse, upload, and download files through a browser.
+
+## Access
+- URL: http://localhost:8085
+- Default login: admin / admin (change immediately!)
+
+## Data
+- Browsed path: $FB_PATH (mounted to /srv)
+- Database: ./database/filebrowser.db
+- Settings: ./config/settings.json
+
+## Manage
+\`\`\`
+cd $FB_DIR
+docker compose up -d      # start
+docker compose down       # stop
+docker compose logs -f    # logs
+\`\`\`
+MD
+
+    local START_FB=""
+    prompt_yn "Start Filebrowser now? (y/n):" "y" START_FB
+    if [ "$START_FB" = "y" ] || [ "$START_FB" = "Y" ]; then
+        docker compose up -d 2>/dev/null && log_success "Filebrowser started" || log_warning "Failed to start"
+    fi
+
+    echo "  Access at:  http://localhost:8085"
+    echo "  Default login: admin / admin (change immediately!)"
+    echo ""
+}