Phase 7+11: token-based publishing — MediaMTX authMethod http -> dumpd /mtx-auth (bridge-only port 8081); dumpd mints 12 h HMAC tokens for Discord-authenticated streamers; dock rewritten (no passwords, naming rules with live preview, prefix/suffix, manual-setup accordion with hidden token); portal uses tokens; configure.py drops streamers; MediaMTX hot-reload, Caddy reload — no stream interruption

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

CommunityDiscordMedia.md

@@ -200,8 +200,7 @@ Checklist:
       admin = member of `admins`; drop `dump-users.txt`
 - [ ] dock: `Dump tonight` sends no credentials; session cookie carries identity
 
-### Phase 7 — dock polish + cleanup
-(partly done: dumpd `/me/stream-key` exists and the live portal's Go Live uses it; the OBS dock still holds its own copy of the key)
+### Phase 7 — dock polish + cleanup  (built with phase 11; apply pending)
 - [ ] `dumpd.py` gains `GET /me` → `{user, groups, stream_key}` for the logged-in streamer;
       dock fills OBS settings from it — nobody types a stream password again
 - [ ] `configure.py` shrinks: hostnames + streamers only (editors and admin live in Authentik)
@@ -264,7 +263,11 @@ Same pattern as Jellyfin: Authentik is the identity, Gitea trusts it.
 - [ ] policy on the Authentik application: who may reach Gitea at all (e.g. `admins` + a `devs` group)
 - [ ] test with a non-admin Discord user; confirm admin mapping via `admins` group
 
-### Phase 11 — MediaMTX auth through Authentik (no stream keys anywhere)
+### Phase 11 — MediaMTX auth through Authentik (no stream keys anywhere)  (built; apply pending)
+Implemented variant: **short-lived HMAC tokens minted by dumpd** for Discord-authenticated members of
+`streamers` (no Authentik app passwords — "Discord only" decision). Dock and portal mint a token per Go Live;
+manual setups get it from the dock's accordion. MediaMTX `authMethod: http` → dumpd `/mtx-auth` on 8081
+(Docker bridge only). Hot-reloaded: no MediaMTX restart.
 Goal: nobody holds a MediaMTX password. "May publish" = Authentik identity + `streamers` group (filled by
 Discord roles); the publish path must start with the user's own name.
 - MediaMTX `authMethod: http`, `authHTTPAddress: http://127.0.0.1:8080/mtx-auth` (dumpd becomes the