fix: drop lan-only ipAllowList (klipper-lb SNATs all LB traffic to 10.42.0.1, so Traefik never sees real client IPs)

Internal-only for argocd/auth/adguard.labzand.com is now enforced at DNS level:
cloudflare-ddns only publishes ns.labzand.com; internal names resolve solely via
AdGuard rewrites. Delete the *.labzand.com A record in Cloudflare once.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>

services/authentik/ingress.yaml

@@ -6,7 +6,6 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: authentik-lan-only@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:

services/authentik/middleware-lan.yaml

@@ -1,13 +0,0 @@
-# Middleware voor auth.labzand.com (alleen intern): blokkeert verkeer
-# van buiten het LAN op de websecure-router.
-# (redirect-https staat in redirect.yaml)
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: lan-only
-  namespace: authentik
-spec:
-  ipAllowList:
-    sourceRange:
-      - 192.168.0.0/16
-      - 127.0.0.1/32