feat(demo): add full inventories for mbazürich and phbern

Both demo sites had only a hosts.yml, so every role ran on its
defaults (authentik.local.test etc.) and nothing was reachable under
the real FQDN. Add the complete group_vars + host_vars analogous to
gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain
bases, matching Bao mounts, DMZ split-horizon (public + *.int.*),
authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC,
collabora, drawio, garage, send, opnform, homarr and bookstack.

authentik_domains lists the *.int.* name too so Traefik requests a
cert the DMZ can verify; the storage proxy outpost carries a config
block (required by the outpost blueprint serializer).

inventories/demo-phbern/host_vars/storage/traefik.yml

@@ -0,0 +1,21 @@
+---
+# Services hosted on `storage` that the DMZ reverseproxy should forward
+# public traffic to. See application/traefik.yml for the mechanism.
+# The garage-webui ForwardAuth no longer needs an auth FQDN pinned here —
+# it talks to the storage-local proxy outpost over the docker network
+# (see garage.yml), and the outpost reaches authentik via the public FQDN
+# over the reverseproxy (firewall now permits backend -> DMZ).
+traefik_dmz_exposed_services:
+  - name: garage-s3
+    domain: s3.phbe.souveredu.ch
+    backend_host: s3.int.phbe.souveredu.ch
+    port: 443
+    protocol: https
+  - name: garage-webui
+    domain: console.s3.phbe.souveredu.ch
+    # Internal name so the DMZ verifies the storage backend cert against a
+    # matching SAN (acme cert_mode, no insecureSkipVerify). garage now
+    # serves this SAN via garage_webui_domains (see garage.yml).
+    backend_host: console.s3.int.phbe.souveredu.ch
+    port: 443
+    protocol: https