Gitea access gated by Authentik group git-users; roles table example

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

CommunityDiscordMedia.md

@@ -258,7 +258,7 @@ Same pattern as Jellyfin: Authentik is the identity, Gitea trusts it.
 - [x] Gitea env: `DISABLE_REGISTRATION=false` + `ALLOW_ONLY_EXTERNAL_REGISTRATION=true` (local self-signup stays
       off), `ENABLE_AUTO_REGISTRATION`, `ACCOUNT_LINKING=auto`, `USERNAME=nickname`, `UPDATE_AVATAR`
 - [ ] optional: hide the password form on the login page (custom template) so Discord is the only visible way in
-- [ ] policy on the Authentik application: who may reach Gitea at all (e.g. `admins` + a `devs` group)
+- [ ] Authentik group `git-users` (from a Discord role) bound on the `Gitea` application (+ `admins`); only they can log in
 - [ ] test with a non-admin Discord user; confirm admin mapping via `admins` group
 
 ### Phase 11 — MediaMTX auth through Authentik (no stream keys anywhere)  ✅ live