Live portal: React + dockview multi-stream viewer behind Authentik; MediaMTX HLS/WebRTC/API re-enabled; is-live Discord hook

live/: every active stream opens as a dockable window (WHEP, HLS fallback), audio follows the
focused window, per-window mute/volume, pinning. Caddy live.HOST block with forward-auth proxies
/api /webrtc /hls to MediaMTX on loopback and serves /srv/live. WebRTC media on 8189 (firewall).
configure.py asks the live hostname and an optional Discord webhook; MediaMTX -ffmpeg image runs
the runOnReady hook. deployLive.sh builds and ships dist/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

firewall/firewall.sh

@@ -15,7 +15,7 @@ systemctl enable nftables >/dev/null 2>&1 || true   # loads /etc/nftables.conf a
 echo "== active ruleset (vanguard table)"
 nft list table inet vanguard | sed 's/^/   /'
 echo
-echo "== listening on public interfaces (should be 22 80 443 1935 2222 3306 8890 22000 only)"
+echo "== listening on public interfaces (should be 22 80 443 1935 2222 3306 8189 8890 22000 only)"
 ss -tulpnH | awk '$5 !~ /^(127\.|\[::1\])/ {print "   "$1, $5}' | sort -u
 echo
 echo "Now open a SECOND terminal and confirm: ssh debian@$(hostname -f 2>/dev/null || hostname)"

firewall/nftables.conf

@@ -46,6 +46,8 @@ table inet vanguard {
 		udp dport 8890 accept                  # SRT ingest
 		tcp dport 22000 accept                 # Syncthing
 		tcp dport 2222 accept                  # Gitea ssh (git clone/push)
+		udp dport 8189 accept                  # WebRTC media for the live portal
+		tcp dport 8189 accept                  # WebRTC ICE-TCP fallback
 		udp dport 22000 accept                 # Syncthing QUIC
 
 		# mariadb (host network): allowlist first, then anywhere with a brute-force limit