frigate: use proxy auth mode with Authelia headers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

services/frigate.nix

@@ -12,7 +12,11 @@
 
       settings = {
         mqtt.enabled = false;
-        auth.enabled = false;
+
+        # Delegate authentication to Authelia via reverse proxy headers.
+        # The nginx /auth location sends requests to Authelia, which returns
+        # Remote-User on success. Frigate picks this up via proxy header_map.
+        auth.proxy.header_map.user = "Remote-User";
 
         cameras.kids_bedroom = {
           enabled = true;