Agent host: SilverBullet serves the vault as its one space, behind Authelia

The operator chose single-space mode: the vault is mounted at /data, with
memory/ read-only over it, and there are no accounts or setup wizard;
Authelia in the operator's Caddy is the login. SB_NAME forces the mode, so
an empty vault can't boot the wizard. SilverBullet's own data folder is
gone. check now fails if the wizard could be open. The README says how to
make memory/ writable for a while and back.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

deploy/agent-host/setup.sh

@@ -7,7 +7,8 @@ set -euo pipefail
 here=$(cd "$(dirname "$0")" && pwd)
 
 # The only address allowed to reach SilverBullet: the operator's Caddy
-# (docker.garrett-hall.com), which serves nisse-memory.dongar.net inside garrett-hall.com.
+# (docker.garrett-hall.com), which serves nisse-memory.dongar.net behind
+# Authelia.
 CADDY_ADDR=192.168.6.13
 SB_PORT=3000
 SB_UID=1000  # the image's PUID/PGID: the operator's side of the vault
@@ -16,7 +17,6 @@ SB_UID=1000  # the image's PUID/PGID: the operator's side of the vault
 # memory/, where each agent gets a folder of its own when it moves in. memory/
 # is root's, and SilverBullet mounts it read-only besides.
 install -d -m 0755 /srv/nisse
-install -d -o "$SB_UID" -g "$SB_UID" -m 0750 /srv/nisse/silverbullet
 install -d -o "$SB_UID" -g "$SB_UID" -m 0755 /srv/nisse/vault
 install -d -o "$SB_UID" -g "$SB_UID" -m 0755 /srv/nisse/vault/infrastructure
 install -d -o root -g root -m 0755 /srv/nisse/vault/memory