Tell the three auth failures apart, and give the Auth tab a settings card

Not set, rejected and unreachable all reached the page as one message about checking
credentials, which sends you to a password when the field is simply empty — as both of
HOST1's were, with no card on the page to fill them in from.

Plugin/unraid/include/confform.php

@@ -124,6 +124,12 @@ const VV_UI_SECTION_SURFACES = [
      'route' => 'Media Stack tab → Media settings'],
     ['match' => 'docker',                   'tab' => 'Docker',
      'route' => 'Docker tab → Docker settings'],
+    // NPM, lldap and Authelia are the three services the Auth tab drives, and Certificate Monitor
+    // is what its Certs panel reports. The credentials in particular belong on the page that fails
+    // without them: a blank NPM_USER surfaces there as a refused login, and the fix is two panels
+    // away rather than in a hundred-and-twenty-field catch-all.
+    ['match' => 'NginxProxyManager|lldap|Authelia|Certificate Monitor', 'tab' => 'Auth',
+     'route' => 'Auth tab → Auth settings'],
 
     // Everything that is not structurally excluded. The catch-all exists so no ordinary setting
     // is reachable only by editing a file — a settings page whose answer to a third of the conf