fix(prowlarr): resolve auth_mode_conflict by using shared authentik middleware

Remove redundant prowlarr_outpost sidecar container and apply the shared
authentik-auth@file middleware to the prowlarr router. The Authentik forward
auth middleware already exists in the Traefik dynamic configuration and
provides the necessary authentication layer without requiring a dedicated
outpost container per service.

nodes/heimdall/prowlarr/compose.yaml

@@ -1,43 +1,35 @@
-###############################################################
-# Networks
-###############################################################
-networks:
-  proxy-net:
-    name: proxy-net
-    external: true
-
-###############################################################
-# Services
-###############################################################
-services:
-  prowlarr:
-    image: lscr.io/linuxserver/prowlarr:2.3.5.5327-ls142
-    container_name: prowlarr
-    mem_limit: 2048m
-    environment:
-      - PUID=0
-      - PGID=0
-      - TZ=America/New_York
-    volumes:
-      - /mnt/appdata/prowlarr/data:/config
-    ports:
-      - 9696:9696 
-    restart: unless-stopped
-    networks:
-      - proxy-net
-  prowlarr_outpost:
-    image: ghcr.io/goauthentik/proxy:2026.2.2
-    container_name: prowlarr_outpost
-    networks:
-      - proxy-net
-    environment:
-      AUTHENTIK_HOST: https://sso.castaldifamily.com
-      AUTHENTIK_TOKEN: 42FCcV9gmTfixaak77xW4eAZIMUUJ0u5vGsxvumfo1Lav5DIyLViDz4xqinE
-      AUTHENTIK_INSECURE: "false"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.prowlarr-proxy.entrypoints=websecure"
-      - "traefik.http.routers.prowlarr-proxy.rule=Host(`prowlarr.castaldifamily.com`)"
-      - "traefik.http.routers.prowlarr-proxy.tls=true"
-      - "traefik.http.routers.prowlarr-proxy.tls.certresolver=cloudflare"
-      - "traefik.http.services.prowlarr-proxy.loadbalancer.server.port=9000"
+###############################################################
+# Networks
+###############################################################
+networks:
+  proxy-net:
+    name: proxy-net
+    external: true
+
+###############################################################
+# Services
+###############################################################
+services:
+  prowlarr:
+    image: lscr.io/linuxserver/prowlarr:2.3.5.5327-ls142
+    container_name: prowlarr
+    mem_limit: 2048m
+    environment:
+      - PUID=0
+      - PGID=0
+      - TZ=America/New_York
+    volumes:
+      - /mnt/appdata/prowlarr/data:/config
+    ports:
+      - 9696:9696
+    restart: unless-stopped
+    networks:
+      - proxy-net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.prowlarr-proxy.entrypoints=websecure"
+      - "traefik.http.routers.prowlarr-proxy.rule=Host(`prowlarr.castaldifamily.com`)"
+      - "traefik.http.routers.prowlarr-proxy.tls=true"
+      - "traefik.http.routers.prowlarr-proxy.tls.certresolver=cloudflare"
+      - "traefik.http.routers.prowlarr-proxy.middlewares=authentik-auth@file,security-headers@file"
+      - "traefik.http.services.prowlarr-proxy.loadbalancer.server.port=9696"