Finish public exposure: monitor.jerodrigged.com is live

Cloudflare tunnel route -> NPM -> dashboard, Let's Encrypt cert via
NPM's API, both public and LAN OIDC redirect URIs registered in
Authentik. Hit and fixed a Flexible-SSL redirect loop (ssl_forced
must stay false since Cloudflare terminates TLS at the edge and talks
plain HTTP to the origin) -- documented clearly so it doesn't get
"fixed" by accident later.

Closes #13.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/oidc-setup.md

@@ -17,8 +17,9 @@ touch any existing user, group, or admin credential.
 - Provider: confidential client, `default-provider-authorization-implicit-consent` flow
   (auto-approve — reasonable for a single-user personal dashboard), signed with
   Authentik's existing self-signed cert.
-- Redirect URI: `http://192.168.1.103:8090/api/auth/oidc/callback` (LAN-only for now;
-  will need a second redirect URI added once issue #13's public exposure lands).
+- Redirect URIs (both registered): `https://monitor.jerodrigged.com/api/auth/oidc/callback` (primary,
+  set in `.env`) and `http://192.168.1.103:8090/api/auth/oidc/callback` (LAN fallback, works if the
+  tunnel/DNS is down).
 - Application slug: `homelab-monitor`.
 
 To change anything (redirect URI, flow, scopes), edit the blueprint file on CT121 and