fix: drop lan-only ipAllowList (klipper-lb SNATs all LB traffic to 10.42.0.1, so Traefik never sees real client IPs)

Internal-only for argocd/auth/adguard.labzand.com is now enforced at DNS level:
cloudflare-ddns only publishes ns.labzand.com; internal names resolve solely via
AdGuard rewrites. Delete the *.labzand.com A record in Cloudflare once.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>

services/argocd/middleware.yaml

@@ -1,6 +1,7 @@
-# Middlewares voor argocd.labzand.com (alleen intern):
-# - redirect-https: http (web) -> https
-# - lan-only: blokkeert verkeer van buiten het LAN op de websecure-router
+# Middleware voor argocd.labzand.com: http (web) -> https redirect.
+# (lan-only ipAllowList verwijderd: k3s klipper-lb SNAT't al LB-verkeer naar
+# 10.42.0.1, waardoor Traefik nooit het echte client-IP ziet. Internal-only
+# wordt afgedwongen via DNS: geen publiek A-record voor interne namen.)
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
@@ -10,14 +11,3 @@ spec:
   redirectScheme:
     scheme: https
     permanent: true
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: lan-only
-  namespace: argocd
-spec:
-  ipAllowList:
-    sourceRange:
-      - 192.168.0.0/16
-      - 127.0.0.1/32