chore(demo-gymburgdorf): finish ACME, LDAP, DMZ routing for live inventory

- ACME via DNS-01 against internal NS (172.16.9.169) with TCP-only +
  disableANSChecks so the DMZ traefik can issue LE certs without
  reaching public NS IPs.
- Migrate single-domain vars to `*_domains` lists (authentik, nextcloud,
  collabora, garage_s3) so public + *.int.* SANs share one cert and
  server-to-server traffic stays in the LAN.
- Wire `traefik_dmz_exposed_services` per backend host (application,
  storage) with explicit `backend_host` overrides pointing at internal
  FQDNs — DMZ traefik now validates upstream certs against SAN names.
- Nextcloud notify_push setup on internal FQDN to avoid DMZ hairpin;
  collabora WOPI / authentik LDAP outpost wired to *.int.* equivalents.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbooks/site.yml

@@ -65,20 +65,20 @@
   roles:
     - digitalboard.core.drawio
 
-- name: Deploy send service
-  hosts: send_servers
-  become: yes
-  roles:
-    - digitalboard.core.send
+# - name: Deploy send service
+#   hosts: send_servers
+#   become: yes
+#   roles:
+#     - digitalboard.core.send
 
-- name: Deploy openforms service
-  hosts: openforms_servers
-  become: yes
-  roles:
-    - digitalboard.core.openforms
+# - name: Deploy openforms service
+#   hosts: openforms_servers
+#   become: yes
+#   roles:
+#     - digitalboard.core.openforms
 
 - name: Deploy opencloud service
   hosts: opencloud_servers
   become: yes
   roles:
-    - digitalboard.core.opencloud
+    - digitalboard.core.opencloud