Self-service clip intake (/clips + dumpd /me/clips via Syncthing REST) and role-aware gateway page (/about + dumpd /me)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

configure.py

@@ -279,6 +279,20 @@ name:   {{http.request.header.X-Authentik-Name}}"
 		file_server
 	}}
 
+	# gateway page: role-aware links + instructions (static; talks to /me)
+	redir /about /about/ 308
+	handle_path /about/* {{
+		root * /srv/about
+		file_server
+	}}
+
+	# clip intake self-service (static page; talks to /me/clips)
+	redir /clips /clips/ 308
+	handle_path /clips/* {{
+		root * /srv/clips
+		file_server
+	}}
+
 	# copyparty. It honours X-Authentik-Username / -Groups only when the request also carries a header whose
 	# secret NAME only this proxy knows (copyparty idp-h-key). Clients cannot forge identity.
 	handle {{
@@ -472,6 +486,7 @@ def apply(domain, admin_pw, streamers, editors, auth_host="", watch_host="", dis
     print("== dump users + restart dumpd")
     run(["sudo", "install", "-d", "-m", "0750", "/etc/vanguard"])
     run(["sudo", "install", "-m", "0600", "stream-token.secret", "/etc/vanguard/stream-token.secret"])
+    run(["sudo", "install", "-m", "0644", "syncthing/stignore", "/etc/vanguard/stignore"])   # dumpd copies it into new clips folders
     run(["sudo", "systemctl", "restart", "dumpd"])
     print("== containers")
     dc = ["docker", "compose"] if (DRY or subprocess.call(["docker", "info"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) == 0) else ["sudo", "docker", "compose"]