Rebuild gaps closed: Authentik bootstrap creds, Gitea install lock + admin user from .env, Syncthing GUI-auth-off fixup, plugin ensured on apply, portal built by install.sh; README rebuild section with the honest manual remainder

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -447,6 +447,32 @@ Turning it on: `DEPLOY_AUTO=1` in `.env`, `./configure.py --apply`, and
 CI: `.gitea/draft-workflows/ci.yml` (inert until moved to `.gitea/workflows/`) runs `check.sh` and the plugin
 tests/build on the Actions runner. The runner never deploys — it must not touch the host.
 
+## Rebuild from scratch (what is and isn't automated)
+
+Server side, scripted:
+
+    git clone ssh://git@git.HOST:2222/techy/Media-Server-Setup.git ~/vanguard-stream   # or scp the folder
+    cd ~/vanguard-stream && sudo bash install.sh        # packages, docker, folders, host scripts, timers, firewall, portal build
+    ./configure.py --full                               # hostnames, secrets, configs, containers, post-start fixups
+
+Restore first if rebuilding a known box: `.env` (all secrets — without it every password is regenerated and
+the databases won't match), `/srv/appdata` (Authentik DB, Jellyfin, Gitea, MariaDB, Syncthing config),
+`/srv/media` (the footage), `/etc/vanguard/clip-quotas.json` if used. With those restored, nothing below is
+needed except DNS.
+
+Post-start fixups `configure.py` performs on every apply (idempotent): Syncthing GUI auth off, Gitea admin
+user created from `.env` (`GITEA_ADMIN_USER` / `GITEA_ADMIN_PASSWORD`; the install page is locked), Jellyfin plugin
+installed from the committed zip. Authentik's `akadmin` password is set on first start from
+`AUTHENTIK_BOOTSTRAP_PASSWORD` in `.env` (no initial-setup page).
+
+Still manual on a truly fresh box (not in the repo; documented in §5c–5g):
+- Authentik: Discord source, identification-stage source, enrollment user type, groups, the two policies,
+  the domain-level proxy provider + outpost host, the Jellyfin and Gitea OIDC providers, application bindings
+- Jellyfin: first-run wizard, libraries (Shows + Vanguard provider), SSO plugin + provider, branding
+- Gitea: authentication source (authentik), deploy key, webhook; `./registerGiteaRunner.sh`
+- Discord developer portal: application, redirect URIs, bot; DNS records
+A `.env`-driven Authentik blueprint would remove the first line (planned).
+
 ## Layout on the server
 
     /srv/media/streams/<user>/<Title>/.live/<ts>.mp4             recording in progress (hidden from Jellyfin/copyparty)