feat(demo): add full inventories for mbazürich and phbern

Both demo sites had only a hosts.yml, so every role ran on its
defaults (authentik.local.test etc.) and nothing was reachable under
the real FQDN. Add the complete group_vars + host_vars analogous to
gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain
bases, matching Bao mounts, DMZ split-horizon (public + *.int.*),
authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC,
collabora, drawio, garage, send, opnform, homarr and bookstack.

authentik_domains lists the *.int.* name too so Traefik requests a
cert the DMZ can verify; the storage proxy outpost carries a config
block (required by the outpost blueprint serializer).

inventories/demo-mbazürich/host_vars/application/traefik.yml

@@ -0,0 +1,46 @@
+---
+# Services hosted on `application` that the DMZ reverseproxy should
+# forward public traffic to. The DMZ traefik picks this up via
+# hostvars[backend].traefik_dmz_exposed_services and renders a router +
+# service for each entry into /config/services.yml.
+traefik_dmz_exposed_services:
+  - name: authentik
+    domain: auth.mbaz.souveredu.ch
+    backend_host: auth.int.mbaz.souveredu.ch
+    port: 443
+    protocol: https
+  - name: nextcloud
+    domain: cloud.mbaz.souveredu.ch
+    backend_host: cloud.int.mbaz.souveredu.ch
+    port: 443
+    protocol: https
+  - name: collabora
+    domain: office.mbaz.souveredu.ch
+    backend_host: office.int.mbaz.souveredu.ch
+    port: 443
+    protocol: https
+  - name: drawio
+    domain: draw.mbaz.souveredu.ch
+    backend_host: draw.int.mbaz.souveredu.ch
+    port: 443
+    protocol: https
+  - name: send
+    domain: send.mbaz.souveredu.ch
+    backend_host: send.int.mbaz.souveredu.ch
+    port: 443
+    protocol: https
+  - name: opnform
+    domain: forms.mbaz.souveredu.ch
+    backend_host: forms.int.mbaz.souveredu.ch
+    port: 443
+    protocol: https
+  - name: homarr
+    domain: home.mbaz.souveredu.ch
+    backend_host: home.int.mbaz.souveredu.ch
+    port: 443
+    protocol: https
+  - name: bookstack
+    domain: wiki.mbaz.souveredu.ch
+    backend_host: wiki.int.mbaz.souveredu.ch
+    port: 443
+    protocol: https