feat(demo): add full inventories for mbazürich and phbern

Both demo sites had only a hosts.yml, so every role ran on its
defaults (authentik.local.test etc.) and nothing was reachable under
the real FQDN. Add the complete group_vars + host_vars analogous to
gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain
bases, matching Bao mounts, DMZ split-horizon (public + *.int.*),
authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC,
collabora, drawio, garage, send, opnform, homarr and bookstack.

authentik_domains lists the *.int.* name too so Traefik requests a
cert the DMZ can verify; the storage proxy outpost carries a config
block (required by the outpost blueprint serializer).

inventories/demo-phbern/host_vars/application/homarr.yml

@@ -0,0 +1,78 @@
+---
+# Bao secret <mount>/data/homarr expected to contain:
+#   secret_encryption_key (64 hex chars), admin_password, oidc_client_secret
+_homarr: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/homarr', url=vault_addr) }}"
+
+homarr_domain: "home.phbe.souveredu.ch"
+homarr_extra_domains:
+  - "home.int.phbe.souveredu.ch"
+homarr_base_url: "https://home.phbe.souveredu.ch"
+
+homarr_secret_encryption_key: "{{ _homarr.secret_encryption_key }}"
+homarr_admin_username: "admin"
+homarr_admin_email: "admin@phbe.souveredu.ch"
+homarr_admin_password: "{{ _homarr.admin_password }}"
+
+# OIDC against Authentik. credentials provider stays enabled as a
+# break-glass account — reach it via /auth/login/credentials when
+# AUTH_OIDC_AUTO_LOGIN bypasses the normal /login page.
+#
+# Issuer must match the `iss` claim authentik emits, which is always the
+# public FQDN. Homarr (oauth4webapi) does a strict 1:1 comparison between
+# the discovery response's issuer and this URL — an internal FQDN here
+# fails with OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED. The public FQDN
+# resolves (internal DNS view) to the DMZ reverseproxy, which the backend
+# subnet can reach, so discovery/token/userinfo stay in the LAN.
+homarr_auth_providers: "credentials,oidc"
+homarr_oidc_issuer: "https://auth.phbe.souveredu.ch/application/o/homarr/"
+homarr_oidc_client_id: "homarr"
+homarr_oidc_client_secret: "{{ _homarr.oidc_client_secret }}"
+homarr_oidc_client_name: "Authentik"
+homarr_oidc_scopes: "openid profile email groups"
+homarr_oidc_groups_attribute: "groups"
+homarr_oidc_auto_login: "true"
+
+# Default board with shortcuts to the other phbern services. Width
+# values describe horizontal grid cells (1-10 desktop / 6 tablet / 2
+# mobile, packed left-to-right).
+homarr_apps:
+  - id: nextcloud
+    name: Nextcloud
+    description: "Cloud Storage & Collaboration"
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/nextcloud.png
+    href: https://cloud.phbe.souveredu.ch
+    width: 2
+  - id: collabora
+    name: Collabora Office
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/collaboraonline.png
+    href: https://office.phbe.souveredu.ch
+    width: 2
+  - id: drawio
+    name: Draw.io
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/drawio.png
+    href: https://draw.phbe.souveredu.ch
+    width: 2
+  - id: send
+    name: Send
+    description: "Encrypted file-share"
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/firefox-send.png
+    href: https://send.phbe.souveredu.ch
+    width: 2
+  - id: opnform
+    name: OpnForm
+    description: "Self-hosted forms"
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/opnform.png
+    href: https://forms.phbe.souveredu.ch
+    width: 2
+  - id: bookstack
+    name: BookStack
+    description: "Wiki & documentation"
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/bookstack.png
+    href: https://wiki.phbe.souveredu.ch
+    width: 2
+  - id: authentik
+    name: Authentik
+    description: "Identity provider"
+    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/authentik.png
+    href: https://auth.phbe.souveredu.ch
+    width: 2