feat(services): refine split-horizon OIDC routing and harden nextcloud patch

- authentik: address the rewrite service by compose service name instead
  of a network alias on the public FQDN, which shadowed extra_hosts pins
  and broke OIDC discovery for c-ares-based (Node) resolvers
- homarr: add homarr_extra_hosts to pin the IdP FQDN to a LAN IP so OIDC
  discovery stays in-network while the issuer matches the browser-facing URL
- opnform: add opnform_oidc_sso_redirect_root to 302 the root URL to the
  SSO path (deep-links untouched, /login?bypass=1 break-glass); restart
  ingress via container restart so envsubst re-renders nginx.conf
- nextcloud: make the UserConfig sed workaround fail loud on upstream
  drift instead of silently skipping (nextcloud/server#59629)
- gitignore: exclude the local .ansible/ collection cache

roles/authentik/templates/docker-compose.yml.j2

@@ -44,13 +44,14 @@ services:
         condition: service_healthy
     networks:
       {{ authentik_backend_network }}: {}
-      # Network alias so traefik (which shares this network) can resolve
-      # the canonical FQDN to this container directly. The URL-based
-      # service below uses that to send upstream traffic with a fixed
-      # Host header equal to the canonical hostname.
-      {{ authentik_traefik_network }}:
-        aliases:
-          - {{ authentik_domains[0] }}
+      # No alias for the public FQDN here: that would shadow `/etc/hosts`
+      # pins (extra_hosts) in other containers sharing this network and
+      # break OIDC discovery for Node-based clients (c-ares-based
+      # resolvers consult Docker DNS before /etc/hosts). The URL-based
+      # service below addresses this container by its compose service
+      # name `server`, which Docker exposes as an alias on every network
+      # the container joins.
+      {{ authentik_traefik_network }}: {}
     labels:
       - traefik.enable=true
       - traefik.docker.network={{ authentik_traefik_network }}
@@ -68,14 +69,14 @@ services:
       - traefik.http.services.{{ authentik_service_name }}.loadbalancer.server.port={{ authentik_port }}
 {% if authentik_host_rewrite_domains | length > 0 %}
       # Server-to-server entry: a separate service points at this very
-      # container by the canonical FQDN (resolved via the network alias
-      # above) and disables passHostHeader so the upstream Host header
-      # becomes `{{ authentik_domains[0] }}`. Authentik builds OIDC issuer
-      # URLs from X-Forwarded-Host (not Host), so we also pin that header
-      # via middleware. Together this keeps the iss claim aligned with
-      # the public hostname browsers see during login, even when the
-      # request itself arrived on an internal *.int.* FQDN.
-      - traefik.http.services.{{ authentik_service_name }}-rewrite.loadbalancer.server.url=http://{{ authentik_domains[0] }}:{{ authentik_port }}
+      # container by its compose service name `server` and disables
+      # passHostHeader so the upstream Host header becomes
+      # `{{ authentik_domains[0] }}`. Authentik builds OIDC issuer URLs
+      # from X-Forwarded-Host (not Host), so we also pin that header via
+      # middleware. Together this keeps the iss claim aligned with the
+      # public hostname browsers see during login, even when the request
+      # itself arrived on an internal *.int.* FQDN.
+      - traefik.http.services.{{ authentik_service_name }}-rewrite.loadbalancer.server.url=http://server:{{ authentik_port }}
       - traefik.http.services.{{ authentik_service_name }}-rewrite.loadbalancer.passhostheader=false
       - traefik.http.middlewares.{{ authentik_service_name }}-xfh-rewrite.headers.customrequestheaders.X-Forwarded-Host={{ authentik_domains[0] }}
 {% for d in authentik_host_rewrite_domains %}