feat(demo-gymburgdorf): gate garage-webui via storage-local proxy outpost

Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled
fixes, both relying on roles added in digitalboard.core:

- console.s3 now has an internal name. garage_webui_domains lists both the
  public and console.s3.int.* FQDN, and the DMZ garage-webui route sets
  backend_host: console.s3.int.* so the DMZ->storage hop verifies the
  backend cert against a matching SAN instead of failing on a raw IP (500).

- garage-webui ForwardAuth moves off the embedded outpost (cross-host hop
  mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed
  on storage (authentik_outpost_proxy). The garage Traefik middleware now
  talks to it over the local docker network, and the storage-proxy-outpost
  is registered in authentik with the garage-webui provider. The stale
  auth.gymb pin on storage is dropped; the outpost reaches authentik via
  the reverseproxy (firewall now permits backend -> DMZ).

Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token.

inventories/demo-gymburgdorf/host_vars/application/authentik.yml

@@ -1,7 +1,7 @@
 ---
 # Bao secret expected at <mount>/data/authentik with keys:
 #   secret_key, postgres_password, admin_password,
-#   ldap_outpost_token,
+#   ldap_outpost_token, proxy_outpost_token,
 #   nextcloud_oidc_secret,
 #   opnform_oidc_secret, homarr_oidc_secret, bookstack_oidc_secret
 _authentik: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/authentik', url=vault_addr) }}"
@@ -63,15 +63,25 @@ authentik_proxy_apps:
       authorization_slug: default-provider-authorization-implicit-consent
       invalidation_slug: default-provider-invalidation-flow
 
-# Bind both proxy providers to authentik's built-in embedded outpost so
-# we don't have to deploy a separate proxy outpost container. The
-# embedded outpost listens on the same host:9000 as the authentik server
-# and exposes /outpost.goauthentik.io/auth/traefik for ForwardAuth.
+# Outpost bindings. drawio runs on this (application) host, so its
+# ForwardAuth can use the embedded outpost (same host:9000 as the
+# authentik server). garage-webui runs on the storage host; a cross-host
+# ForwardAuth to the embedded outpost arrives with a mangled
+# X-Forwarded-Host (an extra reverseproxy hop appends :443 / a comma list)
+# and the outpost then fails to match the provider's external_host (404).
+# So garage-webui is bound to a dedicated proxy outpost deployed on
+# storage (role digitalboard.core.authentik_outpost_proxy), whose
+# ForwardAuth endpoint the local storage Traefik reaches over the docker
+# network — no extra hop, clean X-Forwarded-Host.
 authentik_proxy_outposts:
   - name: "authentik Embedded Outpost"
     type: proxy
     providers:
       - drawio
+  - name: "storage-proxy-outpost"
+    type: proxy
+    token: "{{ _authentik.proxy_outpost_token }}"
+    providers:
       - garage-webui
 
 # OIDC clients