feat(garage,authentik): console multi-domain + standalone proxy outpost

Two related additions for gating a cross-host service (garage WebUI on a
storage host) behind authentik without breaking on TLS or X-Forwarded-Host:

garage role:
- Add garage_webui_domains (list), mirroring garage_s3_domains. The
  console router now accepts every entry, so a DMZ reverseproxy can use a
  backend_host whose cert SAN matches an internal *.int.* name instead of
  connecting by IP (which fails acme cert verification). Defaults to the
  single garage_webui_domain so existing inventories are unaffected.

authentik_outpost_proxy role (new):
- Standalone proxy (ForwardAuth) outpost, modelled on authentik_outpost_ldap.
  Co-locate it with the protected service so the ForwardAuth subrequest
  reaches authentik over the local docker network. The embedded outpost
  only works for services on the authentik host: a cross-host subrequest
  routed through an extra reverse-proxy hop arrives with a polluted
  X-Forwarded-Host (port/comma-appended), which the outpost no longer
  matches against the provider's external_host (404).

roles/authentik_outpost_proxy/defaults/main.yml

@@ -0,0 +1,28 @@
+#SPDX-License-Identifier: MIT-0
+---
+# defaults file for authentik_outpost_proxy
+
+# Base directory configuration (inherited from base role or defined here)
+docker_compose_base_dir: /etc/docker/compose
+docker_volume_base_dir: /srv/data
+
+# Service configuration
+authentik_outpost_proxy_service_name: authentik-outpost-proxy
+authentik_outpost_proxy_docker_compose_dir: "{{ docker_compose_base_dir }}/{{ authentik_outpost_proxy_service_name }}"
+
+# Container image (must match authentik server version)
+authentik_outpost_proxy_image: "ghcr.io/goauthentik/proxy:2026.2.2"
+
+# Connection to authentik server
+authentik_outpost_proxy_host: "https://authentik.local.test"
+authentik_outpost_proxy_token: "changeme"
+authentik_outpost_proxy_insecure: "true"
+
+# Traefik network the service-side routers live on, so the local
+# ForwardAuth middleware can reach this outpost over the docker network.
+authentik_outpost_proxy_network: "proxy"
+
+# Extra hosts for DNS resolution within the container (e.g. pinning the
+# authentik FQDN to a backend IP when the public name is unreachable).
+authentik_outpost_proxy_extra_hosts: []
+# - "auth.example.com:192.168.56.11"