feat: public SSO — fhirworx.io domain, Gitea OAuth2, Cloudflare tunnel
Migrate from homelab.fhirworx.io (LAN-only, IP allowlist) to
fhirworx.io (public, Gitea SSO via oauth2-proxy).
- Domain: homelab.fhirworx.io → fhirworx.io across all configs
- SSO: oauth2-proxy (OIDC/Gitea) + auth-handler nginx for Traefik
ForwardAuth (converts 401 → 302 redirect, same as corwins.media
auth_request pattern)
- Cloudflared: tunnel remote config with 20 hostnames → traefik,
DNS CNAME records via CF API
- Bootstrap: `docker compose run --rm wire` — idempotent cold-start
that creates Gitea admin, OAuth2 app, oauth2-proxy credentials,
clears Cloudflare Access apps, syncs tunnel config + DNS
- Dashboard: rebranded FHIRWORX, HTTPS links, API tile added
- Grafana/Woodpecker/Gitea ROOT_URLs updated to HTTPS
982777addb
