Caddy: /whoami on the main host echoes the Authentik identity headers for debugging

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -237,7 +237,9 @@ Design: **Authentik authenticates once for the whole domain; Caddy authorizes pe
    role-id → group table). Bind it to `default-source-enrollment` **and** `default-source-authentication`
    (engine mode `all`, after `discord-guild-member`). From then on giving someone a Discord role gives them
    the matching access on next login; removing it removes it.
-5. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://bot.HOST/` → 403 unless
+5. Debug: `https://HOST/whoami` prints the username/groups headers exactly as the apps receive them.
+   Group changes in Authentik apply on the next login — log out at `https://auth.HOST/` and back in.
+6. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://bot.HOST/` → 403 unless
    you hold the bot role; `https://live.HOST/me/stream-key` shows your username.
 
 Jellyfin and Gitea use OIDC providers instead, not this.

configure.py

@@ -240,6 +240,15 @@ def write_caddy(domain, auth_host="", watch_host="", git_host="", bot_host="", l
 {domain} {{
 	encode zstd gzip
 {AUTHENTIK_FORWARD_AUTH}
+	# who does Authentik say I am? (debug: shows exactly the identity headers the apps receive)
+	handle /whoami {{
+		header Content-Type text/plain
+		respond "user:   {{http.request.header.X-Authentik-Username}}
+groups: {{http.request.header.X-Authentik-Groups}}
+email:  {{http.request.header.X-Authentik-Email}}
+name:   {{http.request.header.X-Authentik-Name}}"
+	}}
+
 	# dump endpoint (python service on the host; identity from the X-Authentik-* headers Caddy just set)
 	handle /dump* {{
 		reverse_proxy 127.0.0.1:8080