feat(demo): add full inventories for mbazürich and phbern

Both demo sites had only a hosts.yml, so every role ran on its
defaults (authentik.local.test etc.) and nothing was reachable under
the real FQDN. Add the complete group_vars + host_vars analogous to
gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain
bases, matching Bao mounts, DMZ split-horizon (public + *.int.*),
authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC,
collabora, drawio, garage, send, opnform, homarr and bookstack.

authentik_domains lists the *.int.* name too so Traefik requests a
cert the DMZ can verify; the storage proxy outpost carries a config
block (required by the outpost blueprint serializer).

inventories/demo-phbern/host_vars/application/authentik_outpost_ldap.yml

@@ -0,0 +1,13 @@
+---
+# Same token as authentik_ldap_outpost.token above — outpost uses it to
+# authenticate against the authentik server it talks to.
+_authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/authentik', url=vault_addr) }}"
+
+# Public FQDN resolves (internal DNS view) to the DMZ reverseproxy the
+# backend subnet can reach, so the outpost->authentik round-trip stays in
+# the LAN with a valid cert and matches the iss claim authentik emits.
+authentik_outpost_ldap_host: "https://auth.phbe.souveredu.ch"
+authentik_outpost_ldap_token: "{{ _authentik.ldap_outpost_token }}"
+# auth.phbe.* presents a valid Let's Encrypt cert via the reverseproxy, so
+# verify the chain instead of relying on the role's insecure default.
+authentik_outpost_ldap_insecure: "false"