#1345 fix: paperclip authenticated mode and required config fields

Summary

• Use authenticated mode on kyber (local_trusted rejects 0.0.0.0 binding)
• Add required $meta (version, updatedAt, source) and logging fields to template
• Auth is still handled at Cloudflare tunnel / nginx ingress level

Problem

• local_trusted mode rejects 0.0.0.0 host binding — but we need it for k8s to reach paperclip
• Config validation requires $meta.updatedAt, $meta.source (enum), and logging section

---

Summary by cubic

Switches Paperclip on Kyber to authenticated mode, adds required config metadata/logging, and restricts access to the expected hostname. Fixes 0.0.0.0 binding rejection and config validation errors.

• Bug Fixes
  • Set server.deploymentMode to authenticated on Kyber (keep local_trusted elsewhere); required for k8s 0.0.0.0 binding; external auth stays at Cloudflare tunnel/nginx ingress.
  • Add required $meta (version, updatedAt, source) and logging to config.template.json.
  • Add server.allowedHostnames and set paperclip.shunkakinoki.com on Kyber.
  • Wire __DEPLOYMENT_MODE__ and __ALLOWED_HOSTNAME__ via Nix and hydrate.sh. Remove EnvironmentFile from the Paperclip systemd service.
  • Format config.template.json for consistency.