feat(traefik-forward-auth): serve several domains and portals from one instance

A session cookie scoped to one registrable domain is never sent to a host under
another, so an app on a second domain could not be protected by this instance at
all. It failed with a 500 naming the cause: "return URL host does not match any
configured cookie domain".

`domains` is now a list of {domain, authHost}, matching the upstream
`server.domains` schema. The chart previously emitted `server.hostname` and
`cookies.domain`, which are not in 4.14.1's documented options — a deprecated
form that still worked. The single-domain values remain as shorthand and fold
into one entry, so an existing release renders the same protection it did before.

`portals` is a list too. A portal is one OAuth2 client, chosen by the middleware
address, so two portals means two Pocket ID applications — which is how access
can be separated per domain rather than merely shared across them. Each portal
gets its own Middleware and its own mounted secret, under
/var/run/secrets/traefik-forward-auth/<portal>/.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

traefik-forward-auth/templates/configmap.yaml

@@ -1,3 +1,5 @@
+{{- $portals := include "tfa.portals" . | fromYamlArray -}}
+{{- $domains := include "tfa.domains" . | fromYamlArray -}}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -7,21 +9,26 @@ metadata:
 data:
   config.yaml: |
     server:
-      hostname: {{ .Values.hostname | quote }}
+      # One entry per domain served. `domain` scopes the session cookie and
+      # `authHost` is where this service is reachable for that domain.
+      domains:
+        {{- range $domains }}
+        - domain: {{ .domain | quote }}
+          authHost: {{ .authHost | quote }}
+        {{- end }}
 
     tokens:
       sessionLifetime: {{ .Values.tokens.sessionLifetime }}
 
-    cookies:
-      domain: {{ .Values.cookieDomain | quote }}
-
     portals:
-      - name: {{ .Values.portal.name | quote }}
+      {{- range $portals }}
+      - name: {{ .name | quote }}
         providers:
           - pocketID:
-              endpoint: {{ .Values.pocketID.endpoint | quote }}
-              clientID: {{ .Values.pocketID.clientID | quote }}
-              clientSecretFile: "/var/run/secrets/traefik-forward-auth/client-secret"
+              endpoint: {{ .endpoint | quote }}
+              clientID: {{ .clientID | quote }}
+              clientSecretFile: "{{ include "tfa.secretDir" $ }}/{{ .name }}/client-secret"
+      {{- end }}
     {{- with .Values.extraConfig }}
     {{ . | nindent 4 }}
     {{- end }}