infra/ingress_factory: add auth = "app" mode for self-authed backends

Adds a fourth auth tier alongside required/public/none. "app" is
functionally identical to "none" — no Authentik middleware attached —
but the distinct name records intent at the call site: this backend
has its own user login (NextAuth, Django, OAuth, bearer-token API,
etc.) and Authentik would only break it.

Why the new tier: with only required/none, every "the app has its
own auth so drop Authentik" decision looked identical at the call
site to "this is an OAuth callback / webhook receiver / native-client
API". Future readers couldn't tell whether a stack was intentionally
unauthenticated or relying on backend auth. Now they can.

Migrates the 8 stacks flipped earlier this session (novelapp, immich,
linkwarden, tandoor, freshrss, affine, actualbudget, ebooks/audiobookshelf)
from "none" to "app". Confirmed no-op: `tg plan` on novelapp showed
"No changes" — same middleware chain, same live state.

The variable description and the .claude/CLAUDE.md Auth section now
spell out the anti-exposure rule: only pick "app" or "none" AFTER
verifying the app has its own user auth ("app") or the endpoint is
intentionally public ("none"). Default stays "required" so accidental
omission fails closed.

[ci skip]

stacks/actualbudget/factory/main.tf

@@ -156,10 +156,10 @@ resource "kubernetes_service" "actualbudget" {
 
 module "ingress" {
   source = "../../../modules/kubernetes/ingress_factory"
-  # auth = "none": Actual Budget enforces a server password + per-user login
+  # auth = "app": Actual Budget enforces a server password + per-user login
   # on its own sync API. Authentik forward-auth was 302-ing the mobile/web
   # sync clients; Actual's own auth gates users.
-  auth              = "none"
+  auth              = "app"
   namespace         = "actualbudget"
   name              = "budget-${var.name}"
   tls_secret_name   = var.tls_secret_name