bootstrap_sso.py: "lex" joins SUBDOMAINS; --dns-only added the tunnel
ingress entry (25 hostnames, all 24 existing kept) and a proxied CNAME.
Traefik: lex.<domain>/ is rewritten (replacePath) to the static page
Gitea serves, /assets/dossier/ passes through, and a priority-10
catch-all redirects every other lex path to "/" via noop@internal, so
Gitea's own pages never appear on lex. git-sso is first on every lex
chain. The old git.<domain>/dossier now 302s to lex before SSO, so
sign-in lands on lex; the unused dossier-page rewrite is gone and the
git-host /assets/dossier/ routers stay behind SSO.
Page: title "lex · Home or Residence Services"; the navbar reads
"fhirworx | lex" with links back to git.<domain>; the banner says what
lex is (Latin for law; a legal-epidemiology workbench) and keeps the
build status as a smaller second line.
37fb8d2d68