v0.9.6: README generation + migrate authelia + 5 services

- lib/common.sh: add write_readme helper. Every module now writes a README.md
  into its ~/docker/<service>/ folder (self-documenting service folders).
- services/authelia.sh: SSO + 2FA portal, ported from the authelia-setup repo +
  the monolith's working block (secrets + Argon2 hash generation, caddy_net,
  Caddyfile forward-auth snippet + portal block, README). Guards against
  clobbering an existing install.
- services/{filebrowser,ntfy,uptimekuma,portainer,watchtower}.sh: mechanical
  migrations from the monolith, each with a README. Ports 8085/8090/3001/9443/—.

All pass bash -n; ./setup.sh --list shows them under homelab; dry-run run-one
exits 0 for each with real commands guarded.

https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK

services/uptimekuma.sh

@@ -0,0 +1,81 @@
+#!/bin/bash
+# services/uptimekuma.sh — Uptime Kuma uptime/status monitoring.
+# Part of the modular post-install system (sourced by setup.sh).
+
+register_service uptimekuma homelab "Uptime/status monitoring (Uptime Kuma)" 3001
+
+install_uptimekuma() {
+    require_docker || return 1
+    log_info "Installing Uptime Kuma..."
+    local UPTIME_DIR="$DOCKER_DIR/uptime-kuma"
+
+    if [ "$DRY_RUN" = true ]; then
+        echo "[DRY-RUN] Would create $UPTIME_DIR"
+        return 0
+    fi
+
+    mkdir -p "$UPTIME_DIR"
+    ensure_docker_dir_ownership "$UPTIME_DIR"
+    cd "$UPTIME_DIR" || return 1
+
+    cat > docker-compose.yml << 'UPTIME_COMPOSE'
+name: uptime-kuma
+
+services:
+  uptime-kuma:
+    image: louislam/uptime-kuma:1
+    container_name: uptime-kuma
+    hostname: uptime-kuma
+    restart: unless-stopped
+    volumes:
+      - ./data:/app/data
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    ports:
+      - "3001:3001"
+UPTIME_COMPOSE
+
+    mkdir -p data
+    chown -R "$ACTUAL_USER:$ACTUAL_USER" "$UPTIME_DIR"
+
+    echo ""
+    log_success "Uptime Kuma configured at $UPTIME_DIR"
+
+    write_readme "$UPTIME_DIR" << MD
+# Uptime Kuma
+
+Self-hosted uptime/status monitoring dashboard. Monitor websites, servers, and
+Docker containers.
+
+## Access
+- URL: http://localhost:3001
+- Create your admin account on first visit.
+
+## Data
+- App data: ./data (mounted to /app/data)
+- Mounts the Docker socket (read-only) for container monitoring.
+
+## Reverse proxy
+If Caddy is installed, you can expose this via the prompt during install
+(see configure_caddy_for_service). Default subdomain: uptime.
+
+## Manage
+\`\`\`
+cd $UPTIME_DIR
+docker compose up -d      # start
+docker compose down       # stop
+docker compose logs -f    # logs
+\`\`\`
+MD
+
+    # Configure Caddy reverse proxy before starting
+    configure_caddy_for_service "Uptime Kuma" "3001" "uptime"
+
+    local START_UPTIME=""
+    prompt_yn "Start Uptime Kuma now? (y/n):" "y" START_UPTIME
+    if [ "$START_UPTIME" = "y" ] || [ "$START_UPTIME" = "Y" ]; then
+        docker compose up -d 2>/dev/null && log_success "Uptime Kuma started" || log_warning "Failed to start"
+    fi
+
+    echo "  Access at:  http://localhost:3001"
+    echo ""
+}