Without tls.domains traefik requests a certificate covering every host in
the router rule, so an internal *.int extra domain forces its own
_acme-challenge CNAME. Setting opnform_tls_sans (e.g. *.int.<zone>) reuses
the existing wildcard delegation instead - the pattern the hand-run stacks
on the digitalboard production hosts already use.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

@@ -206,0 +211,4 @@
+      # hand-run stacks on the digitalboard production hosts).
+      - traefik.http.routers.{{ opnform_service_name }}.tls.domains[0].main={{ opnform_domain }}
+{% for san in opnform_tls_sans %}
+      - traefik.http.routers.{{ opnform_service_name }}.tls.domains[0].sans={{ san }}

@@ -46,3 +51,3 @@
         }
         default_type text/html;
-        return 200 '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Redirecting to sign-in…</title></head><body style="font-family:sans-serif;text-align:center;padding:3rem;color:#374151"><p id="m">Redirecting to sign-in…</p><script>fetch("/api/auth/{{ opnform_oidc_slug }}/redirect",{method:"POST",headers:{Accept:"application/json"}}).then(function(r){if(!r.ok)throw new Error("HTTP "+r.status);return r.json()}).then(function(d){if(d&&d.redirect_url){window.location.replace(d.redirect_url)}else{throw new Error("no redirect_url")}}).catch(function(e){document.getElementById("m").textContent="Sign-in redirect failed: "+e.message+". Open /login?bypass=1 to use the email form.";});</script></body></html>';
+        return 200 '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Redirecting to sign-in…</title></head><body style="font-family:sans-serif;text-align:center;padding:3rem;color:#374151"><p id="m">Redirecting to sign-in…</p><script>fetch("/api/auth/{{ opnform_oidc_slug }}/redirect",{method:"POST",headers:{Accept:"application/json"}}).then(function(r){if(!r.ok)throw new Error("HTTP "+r.status);return r.json()}).then(function(d){if(d&&d.redirect_url){if(d.state&&d.state_verifier){try{sessionStorage.setItem("oidc_state_verifier:{{ opnform_oidc_slug }}:"+d.state,d.state_verifier)}catch(e){}}window.location.replace(d.redirect_url)}else{throw new Error("no redirect_url")}}).catch(function(e){document.getElementById("m").textContent="Sign-in redirect failed: "+e.message+". Open /login?bypass=1 to use the email form.";});</script></body></html>';