Retire legacy Tailscale hostnames from Finance

[iPior]

Summary

• document auth.szarans.ca as the canonical central Auth hostname
• verify Finance only at https://finance.szarans.ca during deployment
• stop creating the retired finlens_private Docker network in CI/CD

Why

Finance now reaches central Auth through the canonical hostname from both browsers and Docker containers. Split DNS and Caddy select the network path, so the application deployment no longer needs a separate finance.ts.szarans.ca identity.

Production environment

Keep:

BETTER_AUTH_URL=https://finance.szarans.ca
CENTRAL_AUTH_DISCOVERY_URL=https://auth.szarans.ca/api/auth/.well-known/openid-configuration
CENTRAL_AUTH_ISSUER=https://auth.szarans.ca/api/auth
CENTRAL_AUTH_CLIENT_ID=finlens

As part of the final cleanup, reduce trusted origins to:

BETTER_AUTH_TRUSTED_ORIGINS=https://finance.szarans.ca

Keep the existing database URL, Better Auth secret, and OAuth client secret unchanged.

Rollout

After merge, update FINLENS_ENV trusted origins as above and run the normal Finance production deployment.