feat(demo-gymburgdorf): gate garage-webui via storage-local proxy outpost

Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled
fixes, both relying on roles added in digitalboard.core:

- console.s3 now has an internal name. garage_webui_domains lists both the
  public and console.s3.int.* FQDN, and the DMZ garage-webui route sets
  backend_host: console.s3.int.* so the DMZ->storage hop verifies the
  backend cert against a matching SAN instead of failing on a raw IP (500).

- garage-webui ForwardAuth moves off the embedded outpost (cross-host hop
  mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed
  on storage (authentik_outpost_proxy). The garage Traefik middleware now
  talks to it over the local docker network, and the storage-proxy-outpost
  is registered in authentik with the garage-webui provider. The stale
  auth.gymb pin on storage is dropped; the outpost reaches authentik via
  the reverseproxy (firewall now permits backend -> DMZ).

Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token.

inventories/demo-gymburgdorf/hosts.yml

@@ -48,6 +48,14 @@ all:
       hosts:
         application:
 
+    # Proxy (ForwardAuth) outpost co-located with garage on storage, so
+    # the garage-webui ForwardAuth subrequest stays on the local docker
+    # network instead of crossing an extra reverseproxy hop (which mangles
+    # X-Forwarded-Host and breaks the embedded outpost's app matching).
+    authentik_outpost_proxy_servers:
+      hosts:
+        storage:
+
     send_servers:
       hosts:
         application: