Add AUTH_STACK so the Auth tab follows the stack in force

Authentik is the likely destination and the page had Authelia and lldap wired in at every
level, so the seam goes in now: the panels and every endpoint action route off one conf value,
and a stack that cannot be driven yet says so rather than drawing controls with nothing behind.

Plugin/unraid/include/auth.php

@@ -98,6 +98,57 @@ function vv_auth_conf(): array {
     ];
 }
 
+// ── Which stack ───────────────────────────────────────────────────────────────
+
+// The stacks this page knows how to drive, and how far it can drive each one. Declared rather
+// than inferred so the tab can offer a stack it cannot yet operate and say exactly that, instead
+// of drawing panels that call endpoints with nothing behind them — which is how a switch ends up
+// looking like a feature while reading nothing.
+const VV_AUTH_STACKS = [
+    'authelia_lldap' => [
+        'label'    => 'Authelia + lldap',
+        'ready'    => true,
+        'panels'   => ['proxies', 'users', 'acl', 'certs'],
+        'summary'  => 'Authelia holds the access rules, lldap holds users and groups, '
+                    . 'Nginx Proxy Manager holds the hostnames.',
+    ],
+    'authentik' => [
+        'label'    => 'Authentik',
+        'ready'    => false,
+        // Proxies and certs are NPM's, not the identity stack's, so they keep working whichever
+        // stack is selected. Users and access control are the two this page cannot draw yet.
+        'panels'   => ['proxies', 'certs'],
+        'summary'  => 'One stack for identity and access. Varaverk can still manage the proxy '
+                    . 'hosts and certificates, but not Authentik users, groups or policies yet.',
+        'needs'    => 'An API token and base URL in host*.conf, then user, group and policy '
+                    . 'calls against Authentik\'s REST API to sit behind the same page.',
+    ],
+];
+
+// Falls back rather than failing: an unrecognised value means someone typed a stack name into the
+// conf, and answering with a blank tab helps nobody. The working stack is the safe answer, and
+// vv_auth_stack_valid() is what the page uses to say the value was not understood.
+function vv_auth_stack(): string {
+    $v = trim(vv_conf_vars()['AUTH_STACK'] ?? '');
+    return isset(VV_AUTH_STACKS[$v]) ? $v : 'authelia_lldap';
+}
+
+function vv_auth_stack_valid(): bool {
+    $v = trim(vv_conf_vars()['AUTH_STACK'] ?? '');
+    return $v === '' || isset(VV_AUTH_STACKS[$v]);
+}
+
+function vv_auth_stack_def(): array {
+    return VV_AUTH_STACKS[vv_auth_stack()];
+}
+
+// One question, asked the same way by the page and by the endpoint. The page uses it to decide
+// what to draw; api/auth.php uses it to refuse an action belonging to a stack that is not the one
+// in force, so a stale tab left open across a switch cannot write to the wrong directory.
+function vv_auth_panel_on(string $panel): bool {
+    return in_array($panel, vv_auth_stack_def()['panels'], true);
+}
+
 // ── Credential state ──────────────────────────────────────────────────────────
 
 // Three different failures arrive at a token fetch as the same empty string: the credential was

Plugin/unraid/include/confform.php

@@ -128,7 +128,7 @@ const VV_UI_SECTION_SURFACES = [
     // is what its Certs panel reports. The credentials in particular belong on the page that fails
     // without them: a blank NPM_USER surfaces there as a refused login, and the fix is two panels
     // away rather than in a hundred-and-twenty-field catch-all.
-    ['match' => 'NginxProxyManager|lldap|Authelia|Certificate Monitor', 'tab' => 'Auth',
+    ['match' => 'Auth Stack|NginxProxyManager|lldap|Authelia|Certificate Monitor', 'tab' => 'Auth',
      'route' => 'Auth tab → Auth settings'],
 
     // Everything that is not structurally excluded. The catch-all exists so no ordinary setting