Fix SMTP claims and stale Authelia service list

Confirmed live (not from docs): Authelia's in-portal Settings -> Change
Password also emails a one-time code to confirm, same as Forgot
Password — it is not a no-SMTP path as earlier text here assumed.
Reworded all three spots in authelia.sh that claimed otherwise to
point at the admin-side "Edit an existing user" -> "Reset password"
action instead, which never touches email.

Also corrected CLAUDE.md's "No built-in auth — should be protected"
list per an actual grep of services/*.sh: it was missing
drum-rhythm-game, iopaint, paintplus, stirling-pdf, wolf, and the
unconditionally-protected security-dashboard/asterisk, and wrongly
included sky-cam (a non-Docker batch script with no web UI or Caddy
integration at all, nothing for Authelia to protect).

CLAUDE.md

@@ -372,7 +372,23 @@ collision.)
 `filebrowser`, `wg-easy`, `ntfy` (configurable)
 
 **No built-in auth — should be protected:**
-`magicmirror`, `wolf-pair`, `js99er`, `sky-cam`
+`magicmirror`, `wolf-pair`, `js99er`, `drum-rhythm-game`, `iopaint`,
+`paintplus`, `stirling-pdf`, `wolf` (web UI). Each of these prompts
+"Protect X with Authelia SSO? (y/n)" and passes `import authelia` as
+`configure_caddy_for_service`'s extra block when accepted.
+
+`security-dashboard` is Authelia-protected unconditionally (not asked —
+baked into its own Caddy block, since it exposes Asterisk/CrowdSec
+data). `asterisk` offers the same protection for its web admin, with a
+choice between a local `import authelia` and a remote `forward_auth` (see
+the remote-Authelia note earlier in this file).
+
+`sky-cam` was previously listed here but has no Caddy integration or web
+login of any kind — it's a non-Docker batch/cron script that renders
+timelapse videos and posts them to Mattermost, so there's nothing on it
+for Authelia to protect. Removed from this list; if it grows a web UI in
+the future, add it back and wire up the same prompt other services here
+use.
 
 For services without built-in auth, prompt the user before calling
 `configure_caddy_for_service` and pass `import authelia` as the extra block

services/authelia.sh

@@ -573,9 +573,13 @@ docker compose down         # stop
 
 ## Users
 - Login with the **username** (not email). Admin user: \`${AUTHELIA_ADMIN_USER}\`.
-- Tell users to click **Forgot Password** on first login to set their own
-  password (Authelia emails a reset link via SMTP), or use Authelia's own
-  Settings page once logged in — that works even without SMTP configured.
+- Both self-service paths need working SMTP: **Forgot Password** on the login
+  screen emails a reset link, and even the in-portal **Settings → Change
+  Password** page (for an already-logged-in user) sends a one-time code to
+  their email to confirm the change — confirmed live, it is not a
+  no-email path despite Authelia describing it as an in-session action.
+  If SMTP isn't working yet, use the admin-side reset instead (next line),
+  which never touches email.
 - **Add a user:** re-run this installer (\`sudo ./setup.sh authelia\` or
   \`sudo bash authelia.sh\`) and choose **"Add a new user"** from the menu —
   it prompts for username/email/display name, generates the password hash,
@@ -778,10 +782,10 @@ add_authelia_user() {
     echo ""
     echo "  Add a new user to this Authelia instance."
     echo "  They log in with their username (not email). A temporary password"
-    echo "  is generated below — if SMTP isn't working, hand it to them directly"
-    echo "  instead of relying on \"Forgot Password\"; they can set their own"
-    echo "  password afterward from Authelia's own Settings page (no email"
-    echo "  required for that), or via the reset email once SMTP works."
+    echo "  is generated below — hand it to them directly. \"Forgot Password\""
+    echo "  and Authelia's own Settings → Change Password both require working"
+    echo "  SMTP (both email a one-time code), so until that's fixed, use this"
+    echo "  menu's \"Edit an existing user\" → \"Reset password\" for future resets."
     echo ""
     local NEW_USERNAME="" NEW_DISPLAY="" NEW_EMAIL="" NEW_ADMIN=""
     prompt_text "  Username (lowercase, no spaces):" "" NEW_USERNAME
@@ -843,8 +847,11 @@ ${GROUPS_BLOCK}"
     echo "  New user:      ${NEW_USERNAME}"
     echo "  Temp password: ${TEMP_PASS}"
     echo "  Give this to them directly (it's shown once, nothing stores it in"
-    echo "  plaintext). They can log in with it as-is, then change it from"
-    echo "  Authelia's own Settings page — no working SMTP required for that."
+    echo "  plaintext). They can log in with it as-is and keep using it, or"
+    echo "  change it themselves from Authelia's Settings page — but that page"
+    echo "  emails a one-time code to confirm the change, so it needs working"
+    echo "  SMTP. Without SMTP, use this menu's \"Edit an existing user\" →"
+    echo "  \"Reset password\" instead — that one never touches email."
     echo ""
 }