Wire the Security Dashboard into Authelia's per-user access scoping

_authelia_scope_access() (services/authelia.sh) already works for any
Authelia-protected service, forward_auth-gated or OIDC alike -- it's
just never been called from security-dashboard.sh on either the
domain-takeover path (_secdash_offer_asterisk_domain) or the plain
separate-subdomain path, so every domain this dashboard ever protected
defaulted to "any Authelia user", with no way to restrict it to
specific people. That's why the Authelia menu's "Promote to a
specific service's access group" reported no scoped groups existing
yet even after protecting this dashboard with Authelia.

_secdash_configure_caddy() now offers scoping right after the domain
is Authelia-protected (guarded on EXTRA_BLOCK being non-empty, so
Basic-Auth-only or no-auth setups aren't offered a scoping question
for a gate that doesn't exist), guarded by declare -F for standalone
runs where authelia.sh was never sourced. Runs whether the Caddy block
was just freshly written or already existed, so re-running the
installer on an already-configured domain still offers it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SpKTLpwAgZNooTacWeQLuc

services/security-dashboard.sh

@@ -814,6 +814,20 @@ CADDYBLOCK
         log_warning "$SD_DOMAIN already in Caddyfile — leaving the existing entry alone."
     fi
 
+    # Offer per-user access scoping now that this domain is actually
+    # Authelia-protected (local import or remote forward_auth — EXTRA_BLOCK
+    # is only non-empty when one of those was configured above; skip this
+    # entirely for Basic-Auth-only or no-auth setups, where there's no
+    # Authelia gate to scope). This dashboard was never wired into
+    # _authelia_scope_access before now, on either this domain-takeover path
+    # or the plain separate-subdomain path below it — every protected
+    # domain here defaulted to "any Authelia user", with no way to restrict
+    # it to specific people. Guarded by declare -F: this file can run
+    # standalone with authelia.sh never sourced.
+    if [ -n "$EXTRA_BLOCK" ] && declare -F _authelia_scope_access >/dev/null 2>&1; then
+        _authelia_scope_access "security-dashboard" "$SD_DOMAIN"
+    fi
+
     # This port never needs to be open to the internet — only Caddy (local,
     # via host.docker.internal) ever needs to reach it.
     if command -v ufw &>/dev/null; then