Add AUTH_STACK so the Auth tab follows the stack in force

Authentik is the likely destination and the page had Authelia and lldap wired in at every
level, so the seam goes in now: the panels and every endpoint action route off one conf value,
and a stack that cannot be driven yet says so rather than drawing controls with nothing behind.

Deployment/master.conf.template

@@ -1439,6 +1439,23 @@
 # Defined per host in host*.conf — Emby container names and keys differ per server:
 #   HOST1_TRANSCODE_SERVERS / HOST2_TRANSCODE_SERVERS
 
+# ==============================================================================================
+# ── AUTH STACK ────────────────────────────────────────────────────────────────────────────────
+# ==============================================================================================
+
+# ━━━ Auth Stack ━━━
+# Which identity stack this mesh runs behind its protected hostnames. The Auth tab reads this to
+# decide which panels to draw and which endpoints to call — it is a routing switch, not a
+# migration. Changing it does not move users, groups or rules between stacks; stand the new one
+# up first, then point this at it.
+#
+# Mesh-wide rather than per host: auth is the one service the partnership treats as shared, owned
+# by the mesh owner and consumed by everyone else, so two nodes disagreeing about which stack is
+# in force would mean two different answers to "who is this person".
+# "authelia_lldap" — Authelia for access rules, lldap for users and groups. Fully implemented.
+# "authentik"      — single stack for both. NOT IMPLEMENTED YET; the tab says so instead of drawing panels that cannot work.
+    AUTH_STACK="authelia_lldap"
+
 # ==============================================================================================
 # ── MONITORS ──────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
@@ -1706,12 +1723,12 @@
 # earned it — narration for months before anything is allowed near a decision.
 
 # ━━━ AI Master Switch ━━━
-# Fail-closed: anything other than the literal "true" means off.
 # Which node runs the model, the retrieval index and the bug store. Every other node borrows it
 # over the mesh, so a box without a GPU still gets the assistant — it just does not get the AI tab.
 # Defaults to host1 when unset or malformed: whoever builds the mesh is host1.
     AI_OWNER_HOST="host1"
 
+# Fail-closed: anything other than the literal "true" means off.
     AI_ENABLED=false
     AI_CONNECT_TIMEOUT=5            # seconds — probe when resolving which node has Ollama
     AI_REQUEST_TIMEOUT=240          # seconds — must clear a cold model load