Phase 5+6: main host behind Authentik — copyparty trusts X-Authentik-* headers with group permissions (editors, media-admins), dumpd authorizes from headers (admins/media-admins), /sync gated to media-admins, dock drops its dump password; configure.py loses editors/admin

WebDAV continues via Authentik app passwords (provider: Intercept header authentication).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

CommunityDiscordMedia.md

@@ -179,7 +179,7 @@ Checklist:
 - [ ] Medal local filename pattern → add to `ItemTimestamp` (need a sample filename)
 - [ ] later: serve `dist/` at `/plugins/` via Caddy as a plugin repo; theme CSS
 
-### Phase 5 — copyparty behind Authentik  (backend, few users; the one that can lock editors out)
+### Phase 5 — copyparty behind Authentik  (built; apply pending)
 - [ ] Authentik → Providers → Proxy provider, *forward auth (single application)*, external host
       `https://ovh1.HOST`; Application bound to it; add to the embedded outpost
 - [ ] Caddy: `forward_auth 127.0.0.1:9000 { uri /outpost.goauthentik.io/auth/caddy; copy_headers X-Authentik-Username X-Authentik-Groups … }`
@@ -193,7 +193,7 @@ Checklist:
 - [ ] WebDAV: editor creates an app password in Authentik → mounts with Discord username + app password
 - [ ] policy on the Application: only `editors` + `admins` + `streamers` may pass
 
-### Phase 6 — Syncthing UI + dump behind Authentik
+### Phase 6 — Syncthing UI + dump behind Authentik  (built together with phase 5; apply pending)
 - [ ] `/sync/`: forward-auth, policy `admins` only; Syncthing GUI auth can stay as a second layer
 - [ ] `dumpd.py`: read `X-Authentik-Username` / `X-Authentik-Groups` from Caddy instead of basic auth;
       admin = member of `admins`; drop `dump-users.txt`