refactor(demo-gymburgdorf): drop DNS workarounds now backend can reach DMZ

The firewall now permits the backend subnet (172.16.19.0/24) to reach the
DMZ reverseproxy on 443, so server-to-server calls can use the public
FQDN over the reverseproxy instead of the previous workarounds:

- Remove the `*_extra_hosts` pins from nextcloud, opnform, bookstack and
  homarr; their OIDC discovery/issuer now uses the public auth.gymb.* FQDN
  (verified: discovery returns 200 with the public iss over the reverseproxy).
- Switch nextcloud OIDC discovery_url from auth.int.* to auth.gymb.*.
- Drop authentik_host_rewrite_domains and authentik_outpost_domains; point
  the LDAP outpost (both host_vars) at the public auth.gymb.* FQDN.
- Repoint the garage-webui ForwardAuth from the never-functional dedicated
  outpost FQDN to auth.gymb.*. The embedded outpost only serves the auth
  path when Host is a configured authentik_domain and matches the protected
  app via X-Forwarded-Host, so auth.gymb.* stays pinned to the application
  host on storage to bypass the reverseproxy's X-Forwarded-Host stripping.

The *.int.* names and their cert SANs are kept: the DMZ verifies the
backend cert (acme cert_mode) and connects by name, so they remain
structural to the DMZ->backend hop. The console.s3 DMZ route limitation
is pre-existing and tracked separately.

inventories/demo-gymburgdorf/host_vars/storage/traefik.yml

@@ -1,18 +1,12 @@
 ---
-# Local traefik needs to reach authentik for the ForwardAuth subrequest
-# the garage-webui router fires. The public IP is unreachable from this
-# subnet (no DMZ hairpin), so pin both auth FQDNs directly at the
-# application host where authentik runs. Without this the forwardauth
-# middleware would time out and every garage-console request would 502.
-# - auth.gymb.* covers any future server-to-server traffic on the public
-#   FQDN.
-# - outpost.auth.int.gymb.* is the dedicated outpost endpoint actually
-#   used by the ForwardAuth middleware (see garage.yml). It exists only
-#   to skip Authentik's ASGI handler, which 404s the outpost path when
-#   Host is one of the configured authentik_domains.
+# The garage-webui ForwardAuth middleware fires a subrequest to authentik
+# (see garage.yml). It must reach the app-host's `authentik` router
+# directly — going via the DMZ reverseproxy strips X-Forwarded-Host, which
+# breaks the embedded outpost's app matching. The internal DNS view points
+# auth.gymb.* at the reverseproxy, so pin it to the application host here
+# to force the single direct hop that preserves the forwarded headers.
 traefik_extra_hosts:
   - "auth.gymb.souveredu.ch:172.16.19.101"
-  - "outpost.auth.int.gymb.souveredu.ch:172.16.19.101"
 
 # Services hosted on `storage` that the DMZ reverseproxy should forward
 # public traffic to. See application/traefik.yml for the mechanism.
@@ -24,8 +18,11 @@ traefik_dmz_exposed_services:
     protocol: https
   - name: garage-webui
     domain: console.s3.gymb.souveredu.ch
-    # No internal FQDN/cert SAN for console.s3 yet — would need an
-    # extra_domain on garage-webui. Until then this route will 500
-    # against the storage backend (cert mismatch on raw IP).
+    # Pre-existing limitation, orthogonal to the DNS cleanup: the DMZ
+    # verifies the storage backend cert (acme cert_mode), but with no
+    # backend_host set it connects by IP, which the storage cert has no
+    # SAN for, so this route fails the TLS verify. Fixing it needs the
+    # garage role to expose a console extra_domain (e.g. console.s3.int.*)
+    # for the backend_host + cert SAN — tracked separately.
     port: 443
     protocol: https