The *arr UIs behind arrproxy prompt "Authentication Required" because
Sonarr v4 refuses remote access when AuthenticationMethod=None. Since
arrproxy + oauth2-proxy already authenticate every user at the front
door, the *arr apps should defer UI auth to the proxy instead of
double-prompting.
Extend the existing apikey-init container for sonarr/radarr/prowlarr to
also idempotently enforce <AuthenticationMethod>External</AuthenticationMethod>
and <AuthenticationRequired>Enabled</AuthenticationRequired> in
/config/config.xml (create or replace, without disturbing ApiKey/UrlBase).
In Servarr v4 External registers the same NoAuthenticationHandler as None
(no username header required) but is exempt from the None remote-access
block, so it stops the UI login prompt without needing arrproxy to forward
any identity header (arrproxy's trustBoundary strips those by design).
unkin-agent