chore(demo-gymburgdorf): finish ACME, LDAP, DMZ routing for live inventory

- ACME via DNS-01 against internal NS (172.16.9.169) with TCP-only +
  disableANSChecks so the DMZ traefik can issue LE certs without
  reaching public NS IPs.
- Migrate single-domain vars to `*_domains` lists (authentik, nextcloud,
  collabora, garage_s3) so public + *.int.* SANs share one cert and
  server-to-server traffic stays in the LAN.
- Wire `traefik_dmz_exposed_services` per backend host (application,
  storage) with explicit `backend_host` overrides pointing at internal
  FQDNs — DMZ traefik now validates upstream certs against SAN names.
- Nextcloud notify_push setup on internal FQDN to avoid DMZ hairpin;
  collabora WOPI / authentik LDAP outpost wired to *.int.* equivalents.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

inventories/demo-gymburgdorf/host_vars/storage/garage.yml

@@ -3,7 +3,12 @@
 #   rpc_secret, admin_token, metrics_token, webui_password
 _garage: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/garage', url=vault_addr) }}"
 
-garage_s3_domain: "s3.gymb.souveredu.ch"
+# First entry is the canonical public S3 FQDN. Additional entries
+# cover internal *.int.* names so server-to-server S3 traffic (e.g.
+# nextcloud → garage) stays in the LAN.
+garage_s3_domains:
+  - "s3.gymb.souveredu.ch"
+  - "s3.int.gymb.souveredu.ch"
 garage_webui_domain: "console.s3.gymb.souveredu.ch"
 garage_use_ssl: true
 garage_webui_enabled: true

inventories/demo-gymburgdorf/host_vars/storage/traefik.yml

@@ -0,0 +1,16 @@
+---
+# Services hosted on `storage` that the DMZ reverseproxy should forward
+# public traffic to. See application/traefik.yml for the mechanism.
+traefik_dmz_exposed_services:
+  - name: garage-s3
+    domain: s3.gymb.souveredu.ch
+    backend_host: s3.int.gymb.souveredu.ch
+    port: 443
+    protocol: https
+  - name: garage-webui
+    domain: console.s3.gymb.souveredu.ch
+    # No internal FQDN/cert SAN for console.s3 yet — would need an
+    # extra_domain on garage-webui. Until then this route will 500
+    # against the storage backend (cert mismatch on raw IP).
+    port: 443
+    protocol: https