chore: move local dev to shiny(-api).local.unbound.se (#314)

`staging-shiny(-api).unbound.se` belonged to the retired AWS staging. Local dev now uses dedicated names, `shiny.local.unbound.se` / `shiny-api.local.unbound.se`, resolved via /etc/hosts. Real staging is `shiny.staging.unbound.se`.

Update /etc/hosts: `192.168.228.2 shiny.local.unbound.se shiny-api.local.unbound.se`. Pairs with shiny/frontend and the infra auth0 change.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
Reviewed-on: #314

k8s/app/certificates.yaml

@@ -29,8 +29,8 @@ spec:
   dnsNames:
   - shiny
   - auth0
-  - staging-shiny.unbound.se
+  - shiny.local.unbound.se
-  - staging-shiny-api.unbound.se
+  - shiny-api.local.unbound.se
   secretName: self-signed-cert-tls
   issuerRef:
     name: self-signed

k8s/app/local-proxy.yaml

@@ -2,7 +2,7 @@
 # Proxies traffic from KinD cluster to host machine for local development
 #
 # Add to /etc/hosts:
-#   192.168.228.2 staging-shiny.unbound.se staging-shiny-api.unbound.se
+#   192.168.228.2 shiny.local.unbound.se shiny-api.local.unbound.se
 #
 # Apply with: kubectl apply -f local-proxy.yaml
 # Delete with: kubectl delete -f local-proxy.yaml
@@ -29,10 +29,10 @@ spec:
   ingressClassName: traefik
   tls:
     - hosts:
-        - staging-shiny.unbound.se
+        - shiny.local.unbound.se
       secretName: self-signed-cert-tls
   rules:
-    - host: staging-shiny.unbound.se
+    - host: shiny.local.unbound.se
       http:
         paths:
           - path: /
@@ -64,10 +64,10 @@ spec:
   ingressClassName: traefik
   tls:
     - hosts:
-        - staging-shiny-api.unbound.se
+        - shiny-api.local.unbound.se
       secretName: self-signed-cert-tls
   rules:
-    - host: staging-shiny-api.unbound.se
+    - host: shiny-api.local.unbound.se
       http:
         paths:
           - path: /