Wire AdGuard Home into Authelia SSO and Homepage dashboard

- adguard.nordhammer.it now routes through Authelia forward auth
  (AdGuard Home itself has no login, so this becomes the single gate)
- Added Authelia ACL rule for the subdomain so default_policy=deny
  returns 401 for redirect instead of 403
- Added AdGuard Home widget to Homepage under Infrastructure

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

services/authelia.nix

@@ -73,6 +73,7 @@ in
             { domain = "camera.nordhammer.it";   policy = "one_factor"; }
             { domain = "homepage.nordhammer.it"; policy = "one_factor"; }
             { domain = "7dtd.nordhammer.it";     policy = "one_factor"; }
+            { domain = "adguard.nordhammer.it";  policy = "one_factor"; }
           ];
         };
 

services/homepage.nix

@@ -259,6 +259,17 @@ in
                 icon = "go2rtc.png";
               };
             }
+            {
+              "AdGuard Home" = {
+                href = "https://adguard.nordhammer.it";
+                description = "Network DNS ad blocker";
+                icon = "adguard-home.png";
+                widget = {
+                  type = "adguard";
+                  url = "http://127.0.0.1:3000";
+                };
+              };
+            }
             {
               "Last Update" = {
                 description = "Most recent nixos-rebuild switch";