Mark cube.yokogawa.tech as the hostname nothing depends on

Kept, but labelled. ai-api reaches Cube as cube:4000 over the proxy network and
never by name, and the operator UI never touches Cube - the hostname exists so
an engineer can open the playground to hand-verify a measure, which a tunnel
does equally well. So it is the first one to drop if this host is being tidied
or the name is wanted elsewhere.

The note is in three places because whoever tidies this host will be reading
one of them and not this repo: above the block in ~/Caddyfile, inline on the
Authelia rule, and here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

authelia/access-rules.md

@@ -14,7 +14,7 @@ Four hostnames join the existing `HTTPS_UserAccess` `two_factor` rule in
 | Hostname | Phase | Serves |
 |---|---|---|
 | `lf.yokogawa.tech` | 2 | Langfuse — traces, prompts, eval runs |
-| `cube.yokogawa.tech` | 5 | Cube semantic layer, playground and REST API |
+| `cube.yokogawa.tech` | 5 | Cube semantic layer, playground and REST API — **not essential**, see below |
 | `api.yokogawa.tech` | 6 | `ai-api` FastAPI |
 | `ai.yokogawa.tech` | 7 | `ai-web` operator UI |
 
@@ -43,6 +43,15 @@ Add each hostname at the phase that needs it. Every domain added here must also
 have a Caddyfile block with `import authelia` (`caddy/ai-routes.caddy`), and
 every Caddyfile block must have a rule here. One without the other is a hole.
 
+**`cube.yokogawa.tech` is the one to drop first** if the host is being tidied or the
+hostname is wanted for something else. Nothing depends on it — `ai-api` reaches Cube as
+`cube:4000` over the proxy network and never by name, and the operator UI never touches
+Cube. It exists so an engineer can open the playground to hand-verify a measure, which an
+SSH tunnel does equally well. Removing it means deleting the Caddy block **and** this
+domain; batch that with an Authelia restart that is happening anyway rather than spending
+an all-user logout on it. The same note is on the host, in `~/Caddyfile` above the block
+and inline on this rule.
+
 **Applied on lin001:** `lf` on 2026-08-20; `cube`, `api` and `ai` on
 2026-08-27, in one Authelia restart. Backup
 `~/authelia/configuration.yml.bak-ai-20260827`. All four now return 302 to the

caddy/ai-routes.caddy

@@ -53,6 +53,14 @@ lf.yokogawa.tech {
 }
 
 # --- Phase 5 -----------------------------------------------------------------
+# NOT ESSENTIAL. Nothing depends on this hostname: ai-api reaches Cube over the
+# proxy network as cube:4000 and never by name, and the operator's screen never
+# touches Cube at all. It exists so an engineer can open Cube's playground to
+# hand-verify a measure - an SSH tunnel does the same job. If this host is being
+# tidied, or a name is wanted for something else, drop this one first. Removing
+# it means deleting this block AND the domain from the Authelia rule; batch that
+# with an Authelia restart that is happening anyway, rather than spending an
+# all-user logout on it.
 cube.yokogawa.tech {
   import authelia
   reverse_proxy cube:4000