feat(traefik-forward-auth): serve several domains and portals from one instance

A session cookie scoped to one registrable domain is never sent to a host under
another, so an app on a second domain could not be protected by this instance at
all. It failed with a 500 naming the cause: "return URL host does not match any
configured cookie domain".

`domains` is now a list of {domain, authHost}, matching the upstream
`server.domains` schema. The chart previously emitted `server.hostname` and
`cookies.domain`, which are not in 4.14.1's documented options — a deprecated
form that still worked. The single-domain values remain as shorthand and fold
into one entry, so an existing release renders the same protection it did before.

`portals` is a list too. A portal is one OAuth2 client, chosen by the middleware
address, so two portals means two Pocket ID applications — which is how access
can be separated per domain rather than merely shared across them. Each portal
gets its own Middleware and its own mounted secret, under
/var/run/secrets/traefik-forward-auth/<portal>/.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

traefik-forward-auth/templates/middleware.yaml

@@ -1,16 +1,24 @@
 {{- if .Values.middleware.enabled }}
+{{- $portals := include "tfa.portals" . | fromYamlArray -}}
+{{- range $portals }}
+---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
-  name: {{ include "tfa.middlewareName" . }}
+  # Referenced by apps as <namespace>-<name>@kubernetescrd. Renaming one detaches
+  # protection from every ingress that names it.
+  name: {{ .middlewareName }}
   labels:
-    {{- include "tfa.labels" . | nindent 4 }}
+    {{- include "tfa.labels" $ | nindent 4 }}
 spec:
   forwardAuth:
-    address: "http://{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local/portals/{{ .Values.portal.name }}"
-    trustForwardHeader: {{ .Values.middleware.trustForwardHeader }}
-    {{- with .Values.middleware.authResponseHeaders }}
+    # The path selects the portal, and therefore which OAuth2 client — which is
+    # how access is separated between domains.
+    address: "http://{{ $.Release.Name }}.{{ $.Release.Namespace }}.svc.cluster.local/portals/{{ .name }}"
+    trustForwardHeader: {{ $.Values.middleware.trustForwardHeader }}
+    {{- with $.Values.middleware.authResponseHeaders }}
     authResponseHeaders:
       {{- toYaml . | nindent 6 }}
     {{- end }}
 {{- end }}
+{{- end }}