Update all docs to reflect current working configuration

- README: update architecture diagram for RTMP+FFmpeg pipeline, add FFmpeg
  install step, fix path descriptions
- obs-setup: switch from WHIP to RTMP output, add FFmpeg prerequisite, fix
  script log messages (MediaMTX starts on load not streaming start), add
  Python setup note, update troubleshooting for game-opus path and audio
- npm-setup: remove Custom Locations GUI instructions (must be empty - all
  locations defined in Advanced tab only), update verify steps to game-opus
  paths, add troubleshooting for WHEP 400/401 causes
- authentik-setup: add section 6 covering both manual account creation and
  self-service enrollment via invite link; clarify User Write stage group
  field is what triggers auto-add (not the invitation form)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/authentik-setup.md

@@ -11,8 +11,6 @@ have admin access.
 1. Authentik admin -> **Directory -> Groups -> Create**
 2. Name: `stream-viewers`
 3. Save.
-4. Add each friend's user account to this group. **Do not** add yourself /
-   your admin account - your access comes from your existing admin group.
 
 ## 2. Create a Proxy Provider
 
@@ -68,7 +66,43 @@ curl -I https://auth.hetherman.cloud/outpost.goauthentik.io/ping
 
 A 200 or 204 means the outpost is up.
 
-## 6. Verify end-to-end
+## 6. Adding friends
+
+You have two options:
+
+### Option A: Create accounts manually (recommended for small groups)
+
+1. **Directory -> Users -> Create**
+   - Set username, name, email
+   - Set a temporary password
+   - Enable "User must change password on next login"
+2. **Directory -> Groups -> stream-viewers -> Users tab -> Add** the new user.
+3. Send your friend the URL (`https://stream.hetherman.cloud`) and their
+   temporary credentials. They set their own password on first login.
+
+### Option B: Self-service enrollment via invite link
+
+This requires a working enrollment flow with an Invitation stage. The key
+requirement is that the **User Write stage** in the enrollment flow must have
+`stream-viewers` set in the **Groups** field - this is what auto-adds new
+users to the group. The invitation form itself has no group field.
+
+1. **Flows & Stages -> Stages** - find or create a User Write stage and set
+   **Groups** to `stream-viewers`.
+2. **Flows & Stages -> Flows** - create an enrollment flow with these stages
+   in order: Invitation stage -> prompt (email/password) -> User Write -> Login.
+3. **Flows & Stages -> Invitations -> Create**:
+   - **Flow**: your enrollment flow
+   - **Single use**: on (one invite per person)
+   - Set an expiry date
+4. Copy the invite link (shown after saving) and send it to your friend. They
+   click it, fill in username/password, and are redirected to the stream.
+
+> **Important:** if friends completed enrollment but were not added to
+> `stream-viewers` (because the User Write stage was not configured), add them
+> manually: **Directory -> Groups -> stream-viewers -> Users tab -> Add**.
+
+## 7. Verify end-to-end
 
 After finishing `docs/npm-setup.md`: