Split hosts: media (gateway at /), files, clips, sync; live gains /dock, /dock/clock, /dump, /me, /time

configure.py: three new host roles (files/sync/clips) in --full, --hosts, .env, Caddy generator;
main host serves about/ at the root (/about* redirects); /time only where it is fetched same-origin.
about/index.html links across hosts; addCommunityMediaServer.sh asks for the new names; Caddyfile.example
regenerated; README/FRESH-INSTALL/HOSTNAME-CHANGE (procedure C)/STATUS updated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

addCommunityMediaServer.sh

@@ -24,7 +24,7 @@ read -r AUTH_CUR WATCH_CUR < <(python3 -c 'import configure as c; h=c.read_hosts
 BASE="${MAIN#*.}"; [[ $MAIN == *.*.* ]] || BASE="$MAIN"
 
 say "Community media server — Phase 1 (Authentik + Jellyfin) on $MAIN"
-echo "Needs two DNS names as CNAMEs to $MAIN. Create them now if you haven't."
+echo "Every hostname below is a CNAME to $MAIN. Create them now if you haven't."
 AUTH=$(ask "Authentik hostname" "${AUTH_CUR:-auth.$BASE}")
 WATCH=$(ask "Jellyfin hostname" "${WATCH_CUR:-watch.$BASE}")
 GIT_CUR=$(python3 -c 'import configure as c; print(c.read_hosts().get("git",""))')
@@ -33,11 +33,17 @@ BOT_CUR=$(python3 -c 'import configure as c; print(c.read_hosts().get("bot",""))
 BOT=$(ask "Bot web UI hostname" "${BOT_CUR:-bot.$BASE}")
 LIVE_CUR=$(python3 -c 'import configure as c; print(c.read_hosts().get("live",""))')
 LIVE=$(ask "Live portal hostname" "${LIVE_CUR:-live.$BASE}")
+FILES_CUR=$(python3 -c 'import configure as c; print(c.read_hosts().get("files",""))')
+FILES=$(ask "Files (copyparty) hostname" "${FILES_CUR:-files.$BASE}")
+SYNC_CUR=$(python3 -c 'import configure as c; print(c.read_hosts().get("sync",""))')
+SYNC=$(ask "Syncthing UI hostname" "${SYNC_CUR:-sync.$BASE}")
+CLIPS_CUR=$(python3 -c 'import configure as c; print(c.read_hosts().get("clips",""))')
+CLIPS=$(ask "Clips self-service hostname" "${CLIPS_CUR:-clips.$BASE}")
 
 # ---- DNS sanity ----------------------------------------------------------------------------------
 say "DNS check"
 MAIN_IP=$(ip_of "$MAIN"); ok=1
-for h in "$AUTH" "$WATCH" "$GIT" "$BOT" "$LIVE"; do
+for h in "$AUTH" "$WATCH" "$GIT" "$BOT" "$LIVE" "$FILES" "$SYNC" "$CLIPS"; do
   ip=$(ip_of "$h")
   if [[ -z $ip ]]; then echo "  $h: does not resolve yet"; ok=0
   elif [[ $ip != "$MAIN_IP" ]]; then echo "  $h -> $ip (main is $MAIN_IP) — points somewhere else"; ok=0
@@ -50,7 +56,7 @@ fi
 
 # ---- write configs, .env, start containers -----------------------------------------------------
 say "Applying (configure.py --hosts)"
-VG_DRY=$DRY python3 configure.py --hosts "$AUTH" "$WATCH" "$GIT" "$BOT" "$LIVE" | sed -n '/== writing/,$p' | grep -vE '^  (techy|diceofire|[a-z0-9_-]+)  password' || true
+VG_DRY=$DRY python3 configure.py --hosts "$AUTH" "$WATCH" "$GIT" "$BOT" "$LIVE" "$FILES" "$SYNC" "$CLIPS" | sed -n '/== writing/,$p' | grep -vE '^  (techy|diceofire|[a-z0-9_-]+)  password' || true
 [[ $DRY == 1 ]] && { echo "(dry run: skipping container wait)"; exit 0; }
 
 # ---- wait ---------------------------------------------------------------------------------------
@@ -150,7 +156,7 @@ PHASE 3 — Jellyfin (direct play only on this CPU)
           Custom CSS:       paste jellyfin/branding.css
         -> Save; reload https://$WATCH/
 
-AUTHENTIK FORWARD-AUTH (gates https://$LIVE/ and https://$BOT/; later the main host) — once:
+AUTHENTIK FORWARD-AUTH (gates every Vanguard host: $MAIN, $FILES, $CLIPS, $SYNC, $LIVE, $BOT) — once:
   1. Applications -> Outposts -> edit "authentik Embedded Outpost" -> config: authentik_host: https://$AUTH
   2. Applications -> Create with provider -> Application "Vanguard sites"; Proxy Provider, authorization
      flow implicit-consent, mode "Forward auth (domain level)", authentication URL https://$AUTH,
@@ -163,9 +169,9 @@ AUTHENTIK FORWARD-AUTH (gates https://$LIVE/ and https://$BOT/; later the main h
      "discord-roles-to-groups" from authentik/discord-roles-to-groups.py (server id + role-id->group table);
      bind to default-source-enrollment AND default-source-authentication (engine mode all).
   5. Test: private window -> https://$LIVE/ -> Discord -> portal; https://$BOT/ -> 403 unless you hold the
-     bot role; https://$LIVE/me/stream-key shows your username.
+     bot role; https://$LIVE/me shows your username and groups.
 
-LIVE PORTAL (https://$LIVE/)
+LIVE PORTAL (https://$LIVE/) — also hosts the OBS dock (https://$LIVE/dock/) and the timecode clock source.
   Deploy the page from the dev box: ./deployLive.sh (builds live/ and copies dist/ to /srv/live).
   WebRTC viewers and Go Live need UDP/TCP 8189 open (firewall rule included). Optional "is live" Discord
   post: LIVE_WEBHOOK_URL in .env (asked by configure.py --full).