ingress: switch dns hostname to technitium native oidc

ingress/README.md

@@ -5,7 +5,7 @@ This stack adds an internal Traefik layer on PD.
 Why this exists:
 - keep Pangolin as the public tunnel/edge from the VPS
 - centralize app routing behind one internal reverse proxy
-- put Authelia in front of selected apps with domain-based policy
+- put centralized auth in front of selected apps with domain-based policy when needed
 - fix browser cert pain for apps like Technitium by terminating the public HTTPS edge before the self-signed backend
 - avoid giving Traefik Docker socket access; routes are explicit file-provider config
 
@@ -15,14 +15,14 @@ Design choices:
 - no ACME on PD
 - no Docker provider / no docker.sock mount
 - Pangolin resources should target `traefik:80` on site 4 when an app is cut over to this layer
-- Authelia remains the identity decision point for domain/group access
+- Authelia remains the identity decision point for `auth.paccoco.com` while migrated apps can use either Traefik forward-auth or app-native OIDC depending on the service.
 
 Current routed hostnames in dynamic config:
 - `auth.paccoco.com` -> Authelia
-- `gitea.paccoco.com` -> Gitea (Authelia-protected)
-- `grafana.paccoco.com` -> Grafana (Authelia-protected)
-- `dns.paccoco.com` -> Technitium (Authelia-protected)
-- `traefik.paccoco.com` -> Traefik dashboard (Authelia-protected)
+- `gitea.paccoco.com` -> Gitea
+- `grafana.paccoco.com` -> Grafana
+- `dns.paccoco.com` -> Technitium (native OIDC inside the app)
+- `traefik.paccoco.com` -> Traefik dashboard
 
 Cutover note:
 - Deploying this stack does not automatically rewrite Pangolin resources.