fix(frigate): publish the authenticated HTTPS listener

[tang-vu]

Frigate's published browser port currently forwards to internal port 5000, where its UI/API bypass login. Forward it to the authenticated HTTPS listener on container port 8971 and carry HTTPS browser metadata through catalog generation, service discovery, API responses and dashboard/sidebar links.

Why this matters

An operator can enable Frigate authentication yet still expose an unauthenticated browser/API through the ODS port mapping. With the exact shipped 0.15.0 image, a disposable instance returned 200 for /api/config through the old HTTP mapping and 401 through HTTPS 8971. The corrected mapping enforces the application's configured authentication at the published browser boundary. Loopback remains the default binding; internal health still uses HTTP port 5000.

The producer is service.ui_scheme: https; catalog and installed-manifest readers preserve it, API/sidebar/status serializers carry it, and browser URL generation uses it. Only https selects TLS; existing services retain HTTP defaults and explicit public_url overrides keep precedence. The README covers generated first-login credentials, persistent accounts/JWT secret, self-signed certificates, existing TLS/auth overrides, trusted reverse proxies and rollback. The camera RTSP password is distinct from web login credentials. This change preserves existing operator configuration and cannot require login if auth.enabled was explicitly disabled.

Regenerating the catalog also restores metadata for the already-tracked, disabled-by-default pixel-inference service that was absent from the checked-in catalog. Its manifest and .disabled Compose file are unchanged; this is discovery metadata, not activation. Other catalog additions in this batch contain the same generated entry, which must appear only once in the combined catalog.

Overlap check

Searched open and closed PRs for Frigate auth, Frigate 8971, Frigate TLS, serviceUrl https and ui_scheme; searched changed production paths for Frigate, URL helpers/registry, catalog generator and API manifest/link readers. #404 restricts bind addresses; #387/#716 concern credential/setup configuration. #1760 adds explicit public-URL overrides, whose precedence is preserved. #1613 changes generic link/path navigation and Chroma health, but does not switch Frigate to its authenticated listener or propagate HTTPS browser metadata. #4735/#4753/#4779 validate user-provided URL strings, a separate input contract. No existing PR covers this published Frigate authentication boundary.

Validation

• New full Extensions-page regression fails on the old http://localhost:8971 link and passes on https://localhost:8971. Installed-manifest/API regression also fails before the change. Focused dashboard, extension, URL and sidebar-registry suites: 50 passed. Lint: 0 errors, 598 existing warnings. Production build passes.
• API manifest scanning and external-link/status handoffs: focused 150 passed; full dashboard API 2,850 passed, 1 skipped, with two existing warnings.
• Real exact-image Compose test: published plan no longer contains target 5000; HTTPS rejects missing/invalid credentials, accepts the generated account, permits authenticated config/user requests, and the same account works after recreation. JWT secret persists. Catalog + live boundary: 2 passed in 166 seconds. No cameras, model download or GPU inference are used. Only the disposable fixture's self-signed certificate is exempted from client trust validation. All fixture containers/networks were removed.
• One earlier live run became unhealthy during startup under the shared host workload; its logs were not retained, so the cause is not claimed resolved. The subsequent full run with diagnostic capture passed using the same production recipe. An earlier UI run also hit a worker-start timeout; the complete focused rerun passed. The path-filtered image workflow repeats the live authentication test independently.
• Scoped pre-commit and git diff --check pass. make gate reproduces the existing root/WSL no-sudo fixture failure; the complete local gate is not claimed green.

Keep draft for independent human review of the authentication and link changes. Live evidence covers Linux amd64 only; browser certificate onboarding, cameras/RTSP/WebRTC, hardware acceleration, ARM and native macOS/Windows activation remain unverified. Port 5000 is still trusted inside the Docker network; RTSP/WebRTC controls are outside this web-listener change. Restore a cold configuration/database backup if an unrelated upgrade needs rollback, and retain the authenticated mapping: reverting it removes browser login enforcement again. Upstream 0.15.0 contract: https://github.com/blakeblackshear/frigate/blob/v0.15.0/docs/docs/configuration/authentication.md.