[codex] Add Authelia landing page and identity proxy

[sidey79]

Summary

• add a dedicated landing.{CADDY_SUBDOMAIN} site protected by Authelia
• expose /api/me on the landing host and as a narrow alias on workflow.*, both rewritten to the internal n8n webhook path
• add a static landing page that derives service URLs from the current host and shows fewer links for family users than for admins

Why

The Authelia default redirect needs a human-friendly landing page, while the page itself needs a small same-origin identity endpoint to decide whether to show admin-only links.

User impact

• authenticated users can land on a simple service hub after Authelia login
• admins see additional links for infrastructure and automation tools
• the identity endpoint is limited to GET/HEAD and does not expose generic n8n backend paths

Validation

• reviewed the Caddy routing against existing forward_auth and mTLS_optional patterns
• ran git diff --check
• did not run caddy validate in a live runtime