Live portal: React + dockview multi-stream viewer behind Authentik; MediaMTX HLS/WebRTC/API re-enabled; is-live Discord hook

live/: every active stream opens as a dockable window (WHEP, HLS fallback), audio follows the
focused window, per-window mute/volume, pinning. Caddy live.HOST block with forward-auth proxies
/api /webrtc /hls to MediaMTX on loopback and serves /srv/live. WebRTC media on 8189 (firewall).
configure.py asks the live hostname and an optional Discord webhook; MediaMTX -ffmpeg image runs
the runOnReady hook. deployLive.sh builds and ships dist/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

firewall/nftables.conf

@@ -46,6 +46,8 @@ table inet vanguard {
 		udp dport 8890 accept                  # SRT ingest
 		tcp dport 22000 accept                 # Syncthing
 		tcp dport 2222 accept                  # Gitea ssh (git clone/push)
+		udp dport 8189 accept                  # WebRTC media for the live portal
+		tcp dport 8189 accept                  # WebRTC ICE-TCP fallback
 		udp dport 22000 accept                 # Syncthing QUIC
 
 		# mariadb (host network): allowlist first, then anywhere with a brute-force limit