fix: inject-loch CSS loads from dashboard subdomain, drop SSO on landing page

The inject-loch middleware was loading loch.css and fav32.png from
//fhirworx.io (bare domain). On docs.fhirworx.io and other subdomains,
this cross-origin fetch hit the dashboard's gitea-sso forwardAuth,
causing a redirect loop through Gitea login that broke the page styling.

Fix: point injected assets at //dashboard.fhirworx.io explicitly, and
remove gitea-sso from the dashboard (public landing page, no secrets).

infra/traefik/dynamic/services.yml

@@ -1,6 +1,6 @@
 {{- $domain := env "DOMAIN" | default "fhirworx.io" -}}
 {{- $reef := dict
-  "dashboard"          (dict "port" "80"    "theme" true  "extra_hosts" (list $domain) "mw" "gitea-sso,secure-headers")
+  "dashboard"          (dict "port" "80"    "theme" true  "extra_hosts" (list $domain) "mw" "secure-headers")
   "docs"               (dict "port" "80"    "theme" true  "mw" "gitea-sso,secure-headers")
   "gitea"              (dict "port" "3000"  "theme" true  "mw" "secure-headers")
   "woodpecker-server"  (dict "port" "8000"  "theme" true  "subdomain" "ci" "mw" "gitea-sso,secure-headers")
@@ -50,7 +50,7 @@ http:
           lastModified: true
           rewrites:
             - regex: "</head>"
-              replacement: '<link rel="icon" type="image/png" sizes="32x32" href="//{{ $domain }}/fav32.png"><link rel="stylesheet" type="text/css" href="//{{ $domain }}/loch.css"></head>'
+              replacement: '<link rel="icon" type="image/png" sizes="32x32" href="//dashboard.{{ $domain }}/fav32.png"><link rel="stylesheet" type="text/css" href="//dashboard.{{ $domain }}/loch.css"></head>'
   routers:
     # auth.DOMAIN — oauth2-proxy public endpoints (login, callback, sign_out)
     auth-host: