Finish the garage-webui SSO that the DNS cleanup left broken. Two coupled
fixes, both relying on roles added in digitalboard.core:
- console.s3 now has an internal name. garage_webui_domains lists both the
public and console.s3.int.* FQDN, and the DMZ garage-webui route sets
backend_host: console.s3.int.* so the DMZ->storage hop verifies the
backend cert against a matching SAN instead of failing on a raw IP (500).
- garage-webui ForwardAuth moves off the embedded outpost (cross-host hop
mangled X-Forwarded-Host -> 404) onto a dedicated proxy outpost deployed
on storage (authentik_outpost_proxy). The garage Traefik middleware now
talks to it over the local docker network, and the storage-proxy-outpost
is registered in authentik with the garage-webui provider. The stale
auth.gymb pin on storage is dropped; the outpost reaches authentik via
the reverseproxy (firewall now permits backend -> DMZ).
Requires a new bao secret key: <mount>/data/authentik proxy_outpost_token.
e32c2202ea