Add Authelia SSO to Frigate — disables its own login, not just a gate in front of it

Frigate has its own built-in login separate from Authelia's session, so
just adding `import authelia` in front of it (the pattern used for
no-built-in-auth services) would leave two independent logins stacked,
defeating the point of Authelia's "remember me" on mobile. Frigate has a
`proxy` auth mode built for exactly this — trust Remote-User/Remote-Groups
from an upstream forward_auth proxy and disable its own login entirely.

- Extend configure_caddy_for_service() with an optional 5th arg for
  sub-directives inside the reverse_proxy block itself (header_up), needed
  to pin an X-Proxy-Secret header so Frigate's proxy-auth trust can't be
  spoofed by a request reaching its published port directly, bypassing
  Caddy/Authelia. Backward compatible — every other caller is unaffected.
- services/frigate.sh: prompt to protect with Authelia when installed;
  wires import authelia + the X-Proxy-Secret header_up into Caddy, and
  only writes config.yml's auth.enabled: False + proxy block once Caddy
  actually confirms it's fronting the domain (never disables the native
  login with nothing else gating access). Reuses the secret across
  reinstalls instead of rotating it. Calls _authelia_scope_access() so
  access can be restricted to specific users instead of every Authelia
  account. Fixed a latent bug in the standalone-mode Caddy stub where the
  auth block was placed after reverse_proxy instead of before it (dead
  code — the same "Authelia never prompts" bug class CLAUDE.md documents
  for the real helper).
- CLAUDE.md: document the new configure_caddy_for_service parameter and
  Frigate's hybrid built-in-auth/forward_auth pattern.

Verified end-to-end against a local test harness (fake Authelia/Caddy
dirs): config.yml, .env, and the generated Caddyfile block all agree on
the shared secret and header names, auth is skipped cleanly when Caddy
isn't configured, and the secret is reused on a second run.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SpKTLpwAgZNooTacWeQLuc

lib/common.sh

@@ -841,11 +841,19 @@ find_free_coturn_range() {
 }
 
 # ── Caddy reverse-proxy wiring (shared by every web service) ─────────────────
-# Usage: configure_caddy_for_service "Name" "UPSTREAM" "default-subdomain" ["extra"]
+# Usage: configure_caddy_for_service "Name" "UPSTREAM" "default-subdomain" ["extra"] ["reverse_proxy-extra"]
 # UPSTREAM: container:port for caddy_net routing (e.g. "filebrowser:80"),
 #           or plain port number for localhost fallback (e.g. "8085").
+# The optional 5th arg is inserted as sub-directives *inside* the
+# reverse_proxy block itself (e.g. "        header_up X-Proxy-Secret abc123")
+# — for the rare case a backend needs a header only reverse_proxy's own
+# header_up can set, as opposed to EXTRA_CONFIG's auth-gate directives that
+# run before reverse_proxy entirely. See services/frigate.sh's Authelia
+# integration for the reference caller (pins X-Proxy-Secret so Frigate's
+# proxy-auth trust can't be spoofed by a request that reaches it directly,
+# bypassing Caddy/Authelia).
 configure_caddy_for_service() {
-    local SERVICE_NAME="$1" SERVICE_UPSTREAM="$2" DEFAULT_SUBDOMAIN="$3" EXTRA_CONFIG="${4:-}"
+    local SERVICE_NAME="$1" SERVICE_UPSTREAM="$2" DEFAULT_SUBDOMAIN="$3" EXTRA_CONFIG="${4:-}" REVERSE_PROXY_EXTRA="${5:-}"
 
     # Out-params (not `local` — callers read these after the call returns) so
     # a caller can tell whether Caddy actually ended up fronting the service
@@ -941,6 +949,15 @@ configure_caddy_for_service() {
         _BLOCK_UPSTREAM="${_THIS_IP}:${_DISPLAY_PORT}"
     fi
 
+    # Bare "reverse_proxy upstream" unless a caller needs sub-directives
+    # (header_up, etc.) inside it — see the REVERSE_PROXY_EXTRA comment above.
+    local _REVERSE_PROXY_LINE="reverse_proxy ${_BLOCK_UPSTREAM}"
+    if [ -n "$REVERSE_PROXY_EXTRA" ]; then
+        _REVERSE_PROXY_LINE="reverse_proxy ${_BLOCK_UPSTREAM} {
+${REVERSE_PROXY_EXTRA}
+    }"
+    fi
+
     local _SITE_BLOCK
     _SITE_BLOCK="$(cat << CADDY_BLOCK
 
@@ -954,7 +971,7 @@ ${SERVICE_DOMAIN} {
     # after it would be dead code that never runs — full bypass regardless
     # of what the auth server's own rules say.
 ${EXTRA_CONFIG}
-    reverse_proxy ${_BLOCK_UPSTREAM}
+    ${_REVERSE_PROXY_LINE}
 
     # Security headers
     header {