Tell the three auth failures apart, and give the Auth tab a settings card

Not set, rejected and unreachable all reached the page as one message about checking
credentials, which sends you to a password when the field is simply empty — as both of
HOST1's were, with no card on the page to fill them in from.

Plugin/unraid/pages/auth.php

@@ -41,6 +41,9 @@
 //   include/auth.php  required directly for initial render
 //   api/auth.php      mutations
 //   api/cert.php      certificate status
+//   api/confform.php  inline conf edits  → include/confui.php
+require_once dirname(__DIR__) . '/include/confui.php';
+require_once dirname(__DIR__) . '/include/ai_chat.php';
 ?>
 <style>
 /* ── Toolbar ─────────────────────────────────────────────────────────────── */
@@ -271,6 +274,44 @@ $isOwner = vv_is_owner();
   <div class="vv-au-modal" id="vv-au-modal"></div>
 </div>
 
+<?php if (vv_ai_ui_on()): ?>
+<div class="vv-card" id="vv-au-ai-card" style="margin-top:12px;">
+  <?php
+  // The factory, the profile registry and the store are three separate emits and none implies
+  // the others — omitting any renders a chat that looks complete and dies on the first click.
+  vv_ai_profiles_script();
+  vv_ai_chat_store_script();
+  vv_ai_chat_assets();
+  // Scoped to the tab. This page's vocabulary is the part of the stack least likely to be in
+  // anyone's head — a proxy host, a forward target, an Authelia policy and an LDAP group are four
+  // different objects that all end up deciding whether one person can open one URL, and the
+  // question is nearly always "which of these is stopping me".
+  vv_ai_chat_markup('vv-au-ai', [
+      'profile'     => 'varaverk',
+      'compact'     => true,
+      'title'       => 'Assistant',
+      'scopeLabel'  => 'Auth',
+      'empty'       => 'Ask about a proxy host, a rule, a group, or why a login is being refused.',
+      'placeholder' => 'Ask about what is on this page…',
+  ]); ?>
+</div>
+<?php endif; ?>
+
+<?php
+// The three services this page drives, plus the cert thresholds behind the Certs panel. They had
+// no card at all until now, so the credentials that make the whole page work were reachable only
+// from the Settings catch-all or over SSH — and an empty NPM_USER renders here as a failed login,
+// which sends you looking for a password rather than a blank field.
+//
+// The match mirrors VV_UI_SECTION_SURFACES in confform.php and has to keep mirroring it: that
+// constant is what tells the assistant where to send someone, and this is what the page actually
+// draws. The two disagreeing means being given directions to a card that is not there.
+//
+// Both passwords render masked and are logged by name only — vv_conf_key_is_secret() matches
+// PASS, so the same key cannot be redacted in the audit log and legible in the form.
+vv_conf_ui_card('vv-cf-auth', 'NginxProxyManager|lldap|Authelia|Certificate Monitor', 'Auth settings');
+?>
+
 <script>
 (function () {
 'use strict';

Plugin/unraid/pages/readme/ui-map.md

@@ -44,7 +44,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## Authelia
 
-Route: Settings tab → All settings → *Authelia*
+Reachable from:
+
+- Auth tab → Auth settings → *Authelia*
+- Settings tab → All settings → *Authelia*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -84,6 +87,7 @@ Reachable from:
 
 - Scheduler tab → **Cert Monitor** → Config → *Certificate Monitor*
 - Scheduler tab → **Weekly Health Digest** → Config → *Certificate Monitor*
+- Auth tab → Auth settings → *Certificate Monitor*
 - Settings tab → All settings → *Certificate Monitor*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
@@ -418,7 +422,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## NginxProxyManager
 
-Route: Settings tab → All settings → *NginxProxyManager*
+Reachable from:
+
+- Auth tab → Auth settings → *NginxProxyManager*
+- Settings tab → All settings → *NginxProxyManager*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -714,7 +721,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## lldap
 
-Route: Settings tab → All settings → *lldap*
+Reachable from:
+
+- Auth tab → Auth settings → *lldap*
+- Settings tab → All settings → *lldap*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -1178,6 +1188,7 @@ Reachable from:
 
 - Scheduler tab → **Cert Monitor** → Config → *Certificate Monitor*
 - Scheduler tab → **Weekly Health Digest** → Config → *Certificate Monitor*
+- Auth tab → Auth settings → *Certificate Monitor*
 - Settings tab → All settings → *Certificate Monitor*
 
 Saved into `master.conf`, which does not need to be opened by hand.