Fix Mattermost Calls, add Authelia to Asterisk web admin

Mattermost Calls:
- Add 8443/udp to compose ports for the Calls plugin RTC server (WebRTC
  direct path; coturn relay is only the fallback, not the sole path)
- Add 8443/udp to UFW rules and router port-forward table
- Warn that WebRTC requires HTTPS — calls silently fail over HTTP
- Prompt for Caddy domain and update MATTERMOST_SITE_URL in .env to match
  the HTTPS URL before Caddy is wired (previously SITEURL was written before
  the domain was known, leaving it as http://localhost:8065)
- Update README with RTC server address field and corrected port table

Asterisk web admin:
- No built-in auth: add Authelia SSO check matching CLAUDE.md pattern
- Set WEB_ADMIN_AUTH_DISABLED=true in .env when Authelia handles auth
  (prevents double-login prompts)

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt

services/asterisk.sh

@@ -396,8 +396,20 @@ ENV
 
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$EA_DIR"
 
-    # ── Caddy for web admin ───────────────────────────────────────────────────
-    configure_caddy_for_service "Asterisk Web Admin" "localhost:8080" "asterisk"
+    # ── Caddy for web admin (with optional Authelia SSO) ──────────────────────
+    # The web admin has no built-in auth; let Authelia gate it if available.
+    local EA_EXTRA_BLOCK=""
+    if [ -d "$DOCKER_DIR/authelia" ]; then
+        local _use_auth=""
+        prompt_yn "Protect Asterisk web admin with Authelia SSO? (y/n):" "y" _use_auth
+        if [[ "$_use_auth" =~ ^[Yy]$ ]]; then
+            EA_EXTRA_BLOCK="    import authelia"
+            # Tell Asterisk's web admin to skip its own auth — Authelia handles it
+            sed -i "s/^WEB_ADMIN_AUTH_DISABLED=.*/WEB_ADMIN_AUTH_DISABLED=true/" "$EA_DIR/.env"
+            log_info "WEB_ADMIN_AUTH_DISABLED=true set (Authelia will handle authentication)"
+        fi
+    fi
+    configure_caddy_for_service "Asterisk Web Admin" "localhost:8080" "asterisk" "$EA_EXTRA_BLOCK"
 
     # ── README ────────────────────────────────────────────────────────────────
     write_readme "$EA_DIR" << MD