>If I wanted to, I could run _everything_ through Authelia first, so you wouldn’t even see the 404 until you log into an account

I'm actually considering this right at the moment. The idea of enforced 2FA just feels a lot safer to me