STATUS/plan: phases 5-7 and 11 live and verified; refreshed unfinished list

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

CommunityDiscordMedia.md

@@ -180,7 +180,7 @@ Checklist:
 - [ ] Medal local filename pattern → add to `ItemTimestamp` (need a sample filename)
 - [ ] later: serve `dist/` at `/plugins/` via Caddy as a plugin repo; theme CSS
 
-### Phase 5 — copyparty behind Authentik  (built; apply pending)
+### Phase 5 — copyparty behind Authentik  ✅ live
 - [ ] Authentik → Providers → Proxy provider, *forward auth (single application)*, external host
       `https://ovh1.HOST`; Application bound to it; add to the embedded outpost
 - [ ] Caddy: `forward_auth 127.0.0.1:9000 { uri /outpost.goauthentik.io/auth/caddy; copy_headers X-Authentik-Username X-Authentik-Groups … }`
@@ -194,13 +194,13 @@ Checklist:
 - [x] decided: no WebDAV (Discord login only); browser downloads
 - [ ] policy on the Application: only `editors` + `admins` + `streamers` may pass
 
-### Phase 6 — Syncthing UI + dump behind Authentik  (built together with phase 5; apply pending)
+### Phase 6 — Syncthing UI + dump behind Authentik  ✅ live
 - [ ] `/sync/`: forward-auth, policy `admins` only; Syncthing GUI auth can stay as a second layer
 - [ ] `dumpd.py`: read `X-Authentik-Username` / `X-Authentik-Groups` from Caddy instead of basic auth;
       admin = member of `admins`; drop `dump-users.txt`
 - [ ] dock: `Dump tonight` sends no credentials; session cookie carries identity
 
-### Phase 7 — dock polish + cleanup  (built with phase 11; apply pending)
+### Phase 7 — dock polish + cleanup  ✅ live (dock mints tokens; no stored credentials)
 - [ ] `dumpd.py` gains `GET /me` → `{user, groups, stream_key}` for the logged-in streamer;
       dock fills OBS settings from it — nobody types a stream password again
 - [ ] `configure.py` shrinks: hostnames + streamers only (editors and admin live in Authentik)
@@ -263,7 +263,7 @@ Same pattern as Jellyfin: Authentik is the identity, Gitea trusts it.
 - [ ] policy on the Authentik application: who may reach Gitea at all (e.g. `admins` + a `devs` group)
 - [ ] test with a non-admin Discord user; confirm admin mapping via `admins` group
 
-### Phase 11 — MediaMTX auth through Authentik (no stream keys anywhere)  (built; apply pending)
+### Phase 11 — MediaMTX auth through Authentik (no stream keys anywhere)  ✅ live
 Implemented variant: **short-lived HMAC tokens minted by dumpd** for Discord-authenticated members of
 `streamers` (no Authentik app passwords — "Discord only" decision). Dock and portal mint a token per Go Live;
 manual setups get it from the dock's accordion. MediaMTX `authMethod: http` → dumpd `/mtx-auth` on 8081