feat(demo): add full inventories for mbazürich and phbern

Both demo sites had only a hosts.yml, so every role ran on its
defaults (authentik.local.test etc.) and nothing was reachable under
the real FQDN. Add the complete group_vars + host_vars analogous to
gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain
bases, matching Bao mounts, DMZ split-horizon (public + *.int.*),
authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC,
collabora, drawio, garage, send, opnform, homarr and bookstack.

authentik_domains lists the *.int.* name too so Traefik requests a
cert the DMZ can verify; the storage proxy outpost carries a config
block (required by the outpost blueprint serializer).

inventories/demo-mbazürich/host_vars/application/drawio.yml

@@ -0,0 +1,20 @@
+---
+drawio_domain: "draw.mbaz.souveredu.ch"
+
+# Internal FQDN the DMZ reverseproxy uses as backend host so its TLS
+# verify matches a cert SAN (the canonical IP-only route has no SAN
+# and breaks with "cannot validate certificate ... no IP SANs"). Same
+# split-horizon pattern as cloud.int.* / auth.int.* / office.int.*.
+drawio_extra_domains:
+  - "draw.int.mbaz.souveredu.ch"
+
+# Gate drawio behind the authentik embedded outpost. The allow-list is
+# managed on the authentik proxy application (admins + users) so the
+# Nextcloud drawio iframe works for every authenticated user.
+# ForwardAuth talks to the embedded outpost on the authentik server's
+# in-network address. Going via the public FQDN routes through a second
+# traefik hop that strips/rewrites X-Forwarded-Host, which breaks
+# authentik's provider matching (it returns 404). Plain HTTP to the
+# container is the path docs recommend for the embedded outpost.
+drawio_authentik_forward_auth: true
+drawio_authentik_forward_auth_url: "http://authentik-server-1:9000/outpost.goauthentik.io/auth/traefik"