immich-frame: LAN-only access via home-lans-only allowlist + dns_type=internal

Viktor asked to tighten who can see the immich-frame deployments: make
them not public while keeping the two Meta Portals working as frames.
The Portal app bakes the URL into the APK, so the same hostnames must
keep loading from the home networks with zero device or router changes.

- New shared Traefik middleware home-lans-only (Sofia/London/Valchedrym
  LANs + 10/8 + internal v6) — separate from local-only so the remote
  LANs don't inherit access to admin surfaces.
- New ingress_factory dns_type="internal": publicly-resolvable A record
  carrying the internal Traefik LB IP (10.0.20.203). Outsiders resolve
  but can't route; WG spokes policy-route 10/8 down the tunnel. Never
  combine the allowlist with proxied DNS (cloudflared pod IPs are in
  10/8 and would bypass it).
- Both frame ingresses: dns_type internal + allowlist attached +
  external_monitor=false (drop the doomed [External] monitors).
- rybbit worker: highlights-immich route/site removed (off Cloudflare).
- Docs: CLAUDE.md/AGENTS.md ingress tiers, networking.md DNS categories,
  design doc docs/plans/2026-07-04-immich-frame-lan-only-design.md.

Pre-verified: London router DNS returns RFC1918 answers unfiltered;
Technitium already CNAMEs both hosts to the LB; no public wildcard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/immich/frame-emo.tf

@@ -144,14 +144,21 @@ resource "kubernetes_service" "immich-frame-emo" {
 
 module "ingress_emo" {
   source = "../../modules/kubernetes/ingress_factory"
-  # Photo-frame kiosk display on Emo's Portal — headless browser pulling images
-  # via an Immich API key (no user login). Forward-auth would 302 the device to
-  # Authentik with no way to complete login.
-  # auth = "none": photo-frame kiosk; headless browser with API key; no user login.
-  auth            = "none"
-  dns_type        = "proxied"
-  namespace       = "immich"
-  name            = "highlights-immich-emo"
-  tls_secret_name = var.tls_secret_name
-  service_name    = "immich-frame-emo"
+  # Photo-frame kiosk display on Emo's Portal Mini (Sofia LAN) — WebView
+  # pulling images via an Immich API key; no user login possible on the
+  # device. Same LAN-only gating as frame.tf: home-lans-only ipAllowList +
+  # dns_type "internal" (Emo's Portal already resolves this host internally
+  # via Technitium; the public internal-IP record covers any resolver).
+  # LAN-only design: docs/plans/2026-07-04-immich-frame-lan-only-design.md.
+  # auth = "none": kiosk WebView, no user auth by design; gated by the home-lans-only ipAllowList instead.
+  auth              = "none"
+  dns_type          = "internal"
+  extra_middlewares = ["traefik-home-lans-only@kubernetescrd"]
+  # Not externally reachable — explicit opt-out so external-monitor-sync
+  # drops the old [External] monitor instead of default-opting it back in.
+  external_monitor = false
+  namespace        = "immich"
+  name             = "highlights-immich-emo"
+  tls_secret_name  = var.tls_secret_name
+  service_name     = "immich-frame-emo"
 }