fix(fider): allow OAuth callbacks to the internal Keycloak

Fider's SSRF guard (validate.WebhookURL) 500s the OAuth callback when the Keycloak host resolves to an internal/overlay IP, so login never completes. Set ALLOW_PRIVATE_NETWORK_TARGETS=true so it can reach the trusted internal Keycloak.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

roles/web-app-fider/templates/env.j2

@@ -1,10 +1,9 @@
-# Fider configuration
-# @see https://docs.fider.io/self-hosted/
-
 BASE_URL={{ lookup('tls', application_id, 'url.base') }}
 DATABASE_URL=postgresql://{{ lookup('database', application_id, 'username') }}:{{ lookup('database', application_id, 'password') }}@{{ lookup('database', application_id, 'host') }}:{{ lookup('database', application_id, 'port') }}/{{ lookup('database', application_id, 'name') }}?sslmode=disable
 JWT_SECRET={{ (application_id ~ lookup('users', 'administrator').password) | hash('sha256') }}
 
+ALLOW_PRIVATE_NETWORK_TARGETS=true
+
 {% if lookup('objstore', application_id, 'enabled') | bool %}
 BLOB_STORAGE=s3
 BLOB_STORAGE_S3_BUCKET={{ lookup('objstore', application_id, 'bucket') }}
@@ -15,13 +14,6 @@ BLOB_STORAGE_S3_REGION={{ lookup('objstore', application_id, 'region') }}
 {% endif %}
 
 {% set email = lookup('email', application_id) %}
-# Email configuration. Fider's env loader hard-requires EMAIL_NOREPLY
-# AND a complete EMAIL_SMTP_* set at startup (it `panic`s otherwise),
-# regardless of whether the relay is reachable, so we render the full
-# block unconditionally. The lookup('email', …) returns infinito.nexus
-# defaults when services.email.enabled is false, which keeps the panic
-# at bay on email-disabled stacks.
-# @see https://docs.fider.io/self-hosted/
 EMAIL_NOREPLY={{ email['from'] }}
 EMAIL_SMTP_HOST={{ email.host }}
 EMAIL_SMTP_PORT={{ email.port }}