feat(demo): add full inventories for mbazürich and phbern

Both demo sites had only a hosts.yml, so every role ran on its
defaults (authentik.local.test etc.) and nothing was reachable under
the real FQDN. Add the complete group_vars + host_vars analogous to
gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain
bases, matching Bao mounts, DMZ split-horizon (public + *.int.*),
authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC,
collabora, drawio, garage, send, opnform, homarr and bookstack.

authentik_domains lists the *.int.* name too so Traefik requests a
cert the DMZ can verify; the storage proxy outpost carries a config
block (required by the outpost blueprint serializer).

inventories/demo-phbern/host_vars/application/collabora.yml

@@ -0,0 +1,16 @@
+---
+# First entry is the canonical public FQDN. Additional entries cover
+# internal *.int.* names so nextcloud's WOPI discovery hits collabora
+# in the LAN with a valid internal cert.
+collabora_domains:
+  - "office.phbe.souveredu.ch"
+  - "office.int.phbe.souveredu.ch"
+
+# Hosts allowed to issue WOPI calls. Both names are listed so collabora
+# accepts the callback from nextcloud regardless of which FQDN it uses.
+collabora_allowed_domains:
+  - "cloud.phbe.souveredu.ch"
+  - "cloud.int.phbe.souveredu.ch"
+
+collabora_frame_ancestors:
+  - "cloud.phbe.souveredu.ch"