fix(sso): pin the onion OIDC issuer via host-gateway in swarm too

The compose-only guard left swarm sso-proxies resolving auth.<onion>
through the embedded DNS, which races container startup and
intermittently hands back a loopback that dead-ends in the task netns
(token exchange refused). The static extra_hosts entry wins in both
modes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

roles/sys-svc-container/templates/onion_oidc_socks.yml.j2

@@ -1,6 +1,5 @@
 {% set _oidc_onion_host = lookup('tls', 'web-app-keycloak', 'domain') %}
-{# TODO: host-gateway extra_hosts only work in compose; swarm needs its own onion OIDC reachability solution. #}
-{% if (DEPLOYMENT_MODE == 'compose') and (lookup('config', application_id, 'services.sso.enabled') | bool) and (_oidc_onion_host is search('\.onion$')) %}
+{% if (lookup('config', application_id, 'services.sso.enabled') | bool) and (_oidc_onion_host is search('\.onion$')) %}
     extra_hosts:
       - "host.docker.internal:host-gateway"
       - "{{ _oidc_onion_host }}:host-gateway"

roles/web-app-keycloak/templates/sso_proxy/container.yml.j2

@@ -18,10 +18,9 @@
       placement:
         constraints:
           - node.role == manager
-{% else %}
+{% endif %}
     extra_hosts:
       - "{{ lookup('domain', 'web-app-keycloak') }}:host-gateway"
-{% endif %}
     healthcheck:
       test: ["CMD", "/bin/oauth2-proxy", "--version"]
       interval: 30s