docs(identity): gate 6f on evidence instead of a week of silence

[PBernaerts]

Documentation only. 6f said "not before one full week of 6e with nothing in the alert channel". That is a weaker gate than it reads as, and it is replaced with a list of things to actually observe.

Why the week was weak

It crosses no boundary that matters. The numbers, read off the code rather than assumed:

lifetime	value
proxy provider access token	hours=1
proxy provider refresh token	days=30
Authelia session, idle	1 week
Authelia session, absolute	1 month

So a soak exercises the one-hour renewal and nothing else. The next boundary is thirty days, which a week would miss anyway. Seven days was a feeling, not a threshold.

The second half measured nothing at all. lldap-sync-members.py raised every alert through urllib, Cloudflare answers that user agent with a 403, and the run carried on. Every alert went nowhere for a month, including the Authelia-fallback alert this gate was built on (found and fixed in #401). Its silence was evidence that the alerting was broken, not that the migration was healthy.

The general rule now sits next to it: never gate a destructive step on the absence of a signal without first proving the signal can arrive.

What replaces it

What the week really stood in for is coverage of the paths a curl does not reach, so the doc names those directly:

1. A test account through onboarding end to end, welcome mail included (welcome_sent_via authentik, no fallback).
2. The negative cases, which are the ones that fail open and quietly: a non-media-users account refused on apex and music; a member 403 on /beheer/; the operator 200 there.
3. Subsonic from a real client and the web UI, since /rest skips the portal entirely and one proves nothing about the other.
4. One session held past an hour, to cross the token renewal rather than assume it.
5. The fallback alert fired on purpose, so the channel is tested rather than assumed. fix(identity): stop trying to trigger a sync no scoped token can trigger #401 is the argument for why this cannot be skipped.
6. df /dev/shm in authentik-server twice, a day apart: the outpost stores sessions there and a full one produces HTTP 400s (upstream #25248). Measure the growth, do not wait for the symptom.
7. Real member traffic through the gates in Loki.

The operator has an admin account and reusable test accounts, which is what makes 1 to 6 generatable on demand instead of waited for.

Item 7 is the honest exception and is marked as such: members use devices nobody can simulate here (Symfonium, Feishin, TV apps, iOS), so it needs some calendar time. The check is still "real clients have been served", not "a week has passed".

Not a licence to hurry

Also recorded: retiring Authelia frees one container, one SMTP token and some tidiness, and unblocks nothing that is scheduled, while its rollback costs an hour with members locked out of everything. Compress the criterion, not the evidence.

6f-pre remains a hard prerequisite regardless, and no amount of soak time addresses it.

Gates

tests/run.sh 39 suites / 0 failures; check-doc-links.sh all links resolve; pre-commit incl. ansible-lint and gitleaks green.