Finish public exposure: monitor.jerodrigged.com is live

Cloudflare tunnel route -> NPM -> dashboard, Let's Encrypt cert via
NPM's API, both public and LAN OIDC redirect URIs registered in
Authentik. Hit and fixed a Flexible-SSL redirect loop (ssl_forced
must stay false since Cloudflare terminates TLS at the edge and talks
plain HTTP to the origin) -- documented clearly so it doesn't get
"fixed" by accident later.

Closes #13.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -20,7 +20,9 @@ OIDC_ENABLED=false
 OIDC_ISSUER_URL=https://192.168.1.208:9443/application/o/homelab-monitor/
 OIDC_CLIENT_ID=
 OIDC_CLIENT_SECRET=
-OIDC_REDIRECT_URI=http://192.168.1.103:8090/api/auth/oidc/callback
+# Public URL is primary since issue #13 shipped; the LAN URL is also registered
+# in Authentik as a fallback (see docs/oidc-setup.md) if you need to switch back.
+OIDC_REDIRECT_URI=https://monitor.jerodrigged.com/api/auth/oidc/callback
 # Authentik's cert is self-signed on the LAN, same situation as Proxmox's API.
 OIDC_ALLOW_INSECURE_TLS=true