The netbird-tunnel.service.j2 reverse-SSH tunnel template was never
instantiated by any task in the role, and its target
netbird_auth_ingress_host=10.2.45.100 was the Caddy HA keepalived VIP,
destroyed in PR #70. The VPS reaches homelab auth over the NetBird mesh
now (netbird-ingress DaemonSet -> Traefik fd99::86), so the tunnel is
dead. Remove the template and its only-consumer vars
(netbird_auth_tunnel_port/ingress_host/ingress_port, netbird_tunnel_ssh_key).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>