feat: Authentik SSO, Caddy routing, Tailscale service mesh

- Authentik SSO: OAuth2 provider created for Homarr Dashboard
  (client_id=homarr, redirect URIs configured, 14 default flows)
- Caddy reverse proxy on ports 9090-9093 routes:
  9090: Authentik, 9091: AppFloyo, 9092: Homarr, 9093: CouchDB
- ii-agent systemd service on port 8001
- Services accessible via tailnet at 100.92.88.64:{9090-9093}
- Tailscale Serve at neon-64gb.tail4e7094.ts.net/hermes
- Infrastructure status receipt in signatures/

signatures/neon_infrastructure_status.json

@@ -0,0 +1,45 @@
+{
+  "schema": "neon_infrastructure_status_v1",
+  "generated_at": "2026-06-30T10:10:00Z",
+  "services": {
+    "authentik": {
+      "direct": "http://100.92.88.64:30001",
+      "caddy": "http://100.92.88.64:9090",
+      "status": "running (302 login redirect)",
+      "admin": "admin / ResearchStack2026",
+      "flows": "14 default flows created",
+      "oauth2_providers": [{"client_id": "homarr", "client_secret": "insecure-homarr-secret-change-me", "app": "Homarr Dashboard"}]
+    },
+    "gotrue": {
+      "direct": "http://100.92.88.64:9999",
+      "status": "running",
+      "admin": "admin@researchstack.info / admin123"
+    },
+    "appflowy_cloud": {
+      "direct": "http://100.92.88.64:8000",
+      "caddy": "http://100.92.88.64:9091",
+      "status": "running (health 200)"
+    },
+    "homarr": {
+      "direct": "http://100.92.88.64:7575",
+      "caddy": "http://100.92.88.64:9092",
+      "status": "running"
+    },
+    "couchdb": {
+      "direct": "http://100.92.88.64:5984",
+      "caddy": "http://100.92.88.64:9093",
+      "status": "running"
+    },
+    "ii_agent": {
+      "port": 8001,
+      "systemd": "enabled",
+      "status": "running"
+    },
+    "hermes_dashboard": {
+      "direct": "http://100.92.88.64:9119",
+      "status": "running"
+    }
+  },
+  "tailscale_serve": "https://neon-64gb.tail4e7094.ts.net:443/hermes",
+  "claim_boundary": "infrastructure-status-only;no-lean-verification"
+}