feat(services): multi-domain routing, split-horizon and OIDC hardening

Bundle of cross-role changes for the gymb services deployment:

- Traefik routers: OR-combine opnform/homarr/bookstack Host rules with new
  *_extra_domains (internal *.int.* FQDNs for a DMZ reverseproxy), and emit
  tls.certresolver only when traefik_cert_mode == acme (drawio, homarr,
  opnform, send).
- Split-horizon: bookstack_extra_hosts / opnform_extra_hosts add container
  /etc/hosts overrides so containers reach the IdP public FQDN over the LAN.
- bookstack: assert the OIDC issuer resolves concretely (reject "//v2.0"),
  allowing non-Entra IdPs that override bookstack_oidc_issuer.
- homarr: derive the bcrypt salt from the password digest so the admin hash
  is idempotent — no spurious template changes / container restarts.
- opnform: PATCH an existing OIDC connection instead of skipping (applies
  corrected inventory on re-run); add OIDC_FORCE_LOGIN (enabled only after
  bootstrap) and an optional direct-SSO ingress entrypoint.

Docs: READMEs and meta/argument_specs.yml updated for all new variables.

roles/bookstack/meta/argument_specs.yml

@@ -37,6 +37,24 @@ argument_specs:
         type: str
         default: wiki.local.test
         description: Hostname used in the Traefik Host rule.
+      bookstack_extra_domains:
+        type: list
+        elements: str
+        default: []
+        description:
+          - Additional hostnames the Traefik router answers on, OR-combined
+            with C(bookstack_domain). Useful for an internal C(*.int.*) FQDN
+            so a DMZ reverseproxy can reach a backend hostname covered by the
+            cert.
+      bookstack_extra_hosts:
+        type: list
+        elements: str
+        default: []
+        description:
+          - Container-level C(/etc/hosts) overrides (Compose C(extra_hosts)
+            entries, C("host:ip")). Useful in split-horizon setups where the
+            BookStack container must reach an IdP's public FQDN (used in the
+            OIDC C(iss) claim) over the LAN rather than via the DMZ.
       bookstack_base_url:
         type: str
         description: Defaults to C("https://{{ bookstack_domain }}").