Harden launcher-only NAS deploy path

infra/synology/deploy-current.sh

@@ -9,6 +9,7 @@ TASKER_REPO="${TASKER_REPO:-}"
 TASKER_SYNC_SOURCE="${TASKER_SYNC_SOURCE:-0}"
 TASKER_CHANGED_BASE="${TASKER_CHANGED_BASE:-}"
 GATEWAY_REPO="${GATEWAY_REPO:-}"
+SYNC_AUTHENTIK_TEMPLATES="${SYNC_AUTHENTIK_TEMPLATES:-0}"
 
 if [[ ! -d "${NAS_ROOT}" ]]; then
   echo "NAS_ROOT not found: ${NAS_ROOT}" >&2
@@ -16,7 +17,7 @@ if [[ ! -d "${NAS_ROOT}" ]]; then
   exit 1
 fi
 
-mkdir -p "${NAS_ROOT}/platform" "${NAS_ROOT}/authentik/custom-templates"
+mkdir -p "${NAS_ROOT}/platform"
 
 rsync -av \
   "${PLATFORM_REPO}/infra/synology/docker-compose.platform-http.yml" \
@@ -31,9 +32,14 @@ rsync -av \
   "${PLATFORM_REPO}/infra/synology/backup-current.sh" \
   "${NAS_ROOT}/platform/"
 
-rsync -av --delete \
-  "${PLATFORM_REPO}/infra/authentik/custom-templates/" \
-  "${NAS_ROOT}/authentik/custom-templates/"
+if [[ "${SYNC_AUTHENTIK_TEMPLATES}" == "1" ]]; then
+  mkdir -p "${NAS_ROOT}/authentik/custom-templates"
+  rsync -av --delete \
+    "${PLATFORM_REPO}/infra/authentik/custom-templates/" \
+    "${NAS_ROOT}/authentik/custom-templates/"
+else
+  echo "SYNC_AUTHENTIK_TEMPLATES=0; Authentik custom templates were not synced."
+fi
 
 if [[ -n "${LAUNCHER_REPO}" ]]; then
   if [[ ! -d "${LAUNCHER_REPO}" ]]; then
@@ -166,7 +172,14 @@ cd /volume1/docker/nodedc-platform/platform
 sudo /usr/local/bin/docker compose \
   --env-file /volume1/docker/nodedc-platform/platform/.env.synology \
   -f /volume1/docker/nodedc-platform/platform/docker-compose.platform-http.yml \
-  up -d --force-recreate launcher reverse-proxy authentik-server authentik-worker
+  up -d --force-recreate --no-deps launcher
+
+Optional Platform/Auth infra apply, only after deliberate compose/proxy/Auth templates changes:
+
+sudo /usr/local/bin/docker compose \
+  --env-file /volume1/docker/nodedc-platform/platform/.env.synology \
+  -f /volume1/docker/nodedc-platform/platform/docker-compose.platform-http.yml \
+  up -d --force-recreate --no-deps reverse-proxy authentik-server authentik-worker launcher
 
 Verify: