feat(demo): add full inventories for mbazürich and phbern

Both demo sites had only a hosts.yml, so every role ran on its
defaults (authentik.local.test etc.) and nothing was reachable under
the real FQDN. Add the complete group_vars + host_vars analogous to
gymburgdorf, with the mbaz.souveredu.ch / phbe.souveredu.ch domain
bases, matching Bao mounts, DMZ split-horizon (public + *.int.*),
authentik OIDC/LDAP/proxy outposts, nextcloud with S3+LDAP+OIDC,
collabora, drawio, garage, send, opnform, homarr and bookstack.

authentik_domains lists the *.int.* name too so Traefik requests a
cert the DMZ can verify; the storage proxy outpost carries a config
block (required by the outpost blueprint serializer).

inventories/demo-phbern/hosts.yml

@@ -22,6 +22,7 @@ all:
     backend_servers:
       hosts:
         application:
+        storage:
 
     garage_servers:
       hosts:
@@ -31,10 +32,6 @@ all:
       hosts:
         application:
 
-    opencloud_servers:
-      hosts:
-        application:
-
     collabora_servers:
       hosts:
         application:
@@ -45,4 +42,32 @@ all:
 
     authentik_servers:
       hosts:
-        application:
+        application:
+
+    authentik_outpost_ldap_servers:
+      hosts:
+        application:
+
+    # Proxy (ForwardAuth) outpost co-located with garage on storage, so
+    # the garage-webui ForwardAuth subrequest stays on the local docker
+    # network instead of crossing an extra reverseproxy hop (which mangles
+    # X-Forwarded-Host and breaks the embedded outpost's app matching).
+    authentik_outpost_proxy_servers:
+      hosts:
+        storage:
+
+    send_servers:
+      hosts:
+        application:
+
+    opnform_servers:
+      hosts:
+        application:
+
+    homarr_servers:
+      hosts:
+        application:
+
+    bookstack_servers:
+      hosts:
+        application: