Drop the external-dns/cloudflare label from the immich Ingress and remove
the immich.renner.uno cloudflared tunnel route, moving the public edge to
the NetBird reverse proxy. immich keeps its own login (no proxy auth
added). The .k.renner.uno LAN alias and legacy photos.renner.uno were
already tunnel-404 via the shared label; LAN/mesh -> Traefik is unaffected.
MERGE ONLY AFTER the immich proxy service + DNS are live, then roll
cloudflared, or immich.renner.uno goes dark in the gap.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>