refactor(demo-gymburgdorf): drop DNS workarounds now backend can reach DMZ

The firewall now permits the backend subnet (172.16.19.0/24) to reach the
DMZ reverseproxy on 443, so server-to-server calls can use the public
FQDN over the reverseproxy instead of the previous workarounds:

- Remove the `*_extra_hosts` pins from nextcloud, opnform, bookstack and
  homarr; their OIDC discovery/issuer now uses the public auth.gymb.* FQDN
  (verified: discovery returns 200 with the public iss over the reverseproxy).
- Switch nextcloud OIDC discovery_url from auth.int.* to auth.gymb.*.
- Drop authentik_host_rewrite_domains and authentik_outpost_domains; point
  the LDAP outpost (both host_vars) at the public auth.gymb.* FQDN.
- Repoint the garage-webui ForwardAuth from the never-functional dedicated
  outpost FQDN to auth.gymb.*. The embedded outpost only serves the auth
  path when Host is a configured authentik_domain and matches the protected
  app via X-Forwarded-Host, so auth.gymb.* stays pinned to the application
  host on storage to bypass the reverseproxy's X-Forwarded-Host stripping.

The *.int.* names and their cert SANs are kept: the DMZ verifies the
backend cert (acme cert_mode) and connects by name, so they remain
structural to the DMZ->backend hop. The console.s3 DMZ route limitation
is pre-existing and tracked separately.

inventories/demo-gymburgdorf/host_vars/application/authentik.yml

@@ -10,26 +10,9 @@ _authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data
 authentik_domains:
   - "auth.gymb.souveredu.ch"
 
-# Internal FQDN for server-to-server calls (Nextcloud OIDC discovery,
-# token, userinfo; LDAP outpost configuration pull). Traefik rewrites
-# the Host header to `authentik_domains[0]` on these routers so authentik
-# still emits issuer URLs against the public hostname — that keeps the
-# iss claim matching what the browser sees while the traffic itself
-# stays inside the LAN (the DMZ has no hairpin-NAT for the public IP).
-authentik_host_rewrite_domains:
-  - "auth.int.gymb.souveredu.ch"
 authentik_secret_key: "{{ _authentik.secret_key }}"
 authentik_postgres_password: "{{ _authentik.postgres_password }}"
 
-# Dedicated FQDN for cross-host ForwardAuth (storage Traefik calling
-# /outpost.goauthentik.io/auth/traefik). Routing through the public
-# auth.gymb.* FQDN doesn't work — Authentik sees Host: auth.gymb.* and
-# routes to ASGI which 404s the outpost path. This FQDN sits outside
-# authentik_domains so the same request falls through to the embedded
-# outpost handler (which matches the protected app via X-Forwarded-Host).
-authentik_outpost_domains:
-  - "outpost.auth.int.gymb.souveredu.ch"
-
 # LDAP outpost (provider for nextcloud)
 authentik_ldap_apps:
   - slug: ldap
@@ -41,9 +24,10 @@ authentik_ldap_outpost:
   name: "ldap-outpost"
   token: "{{ _authentik.ldap_outpost_token }}"
   config:
-    # Outpost pulls config from authentik over the internal FQDN — keeps
-    # the round-trip in the LAN with a valid cert.
-    authentik_host: "https://auth.int.gymb.souveredu.ch/"
+    # Outpost pulls config from authentik over the public FQDN, which
+    # resolves (internal DNS view) to the DMZ reverseproxy the backend
+    # subnet can reach — keeps the round-trip in the LAN with a valid cert.
+    authentik_host: "https://auth.gymb.souveredu.ch/"
     log_level: "info"
 
 # Proxy providers (ForwardAuth) — gate downstream services behind