Use mcp/secrets.hubris.network for the canonical endpoints

Caddy + split-horizon DNS now resolve these to LXC 105 (via 121).
Workstations off-LAN reach them via Netbird (192.168.8.0/24 is a
network resource routed through hubris).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

hosts/apps.yaml

@@ -37,17 +37,18 @@ services_hosted:
 - name: homelab_mcp
   backend: apps
   port: 9810
-  netbird_host: apps.netbird.selfhosted
-  endpoint: http://apps.netbird.selfhosted:9810/sse
-  note: MCP server. Read-only context + management. Mesh-only.
+  public_host: mcp.hubris.network
+  endpoint: https://mcp.hubris.network/sse
+  note: MCP server. Read-only context + management. Reachable on the LAN via Caddy and from off-LAN via
+    Netbird (192.168.8.0/24 is a network resource routed through hubris).
 - name: secrets_issuance
   backend: apps
   port: 9820
-  netbird_host: apps.netbird.selfhosted
-  endpoint: http://apps.netbird.selfhosted:9820/issue
-  note: Issues per-client age private keys. Mesh-only.
+  public_host: secrets.hubris.network
+  endpoint: https://secrets.hubris.network/issue
+  note: Issues per-client age private keys. Gated at source-IP layer (mesh + LAN subnets in MESH_SUBNETS).
 age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 see_also:
 - containers/105-apps.md
-mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
-secrets_issuance_endpoint: http://apps.netbird.selfhosted:9820/issue
+mcp_endpoint: https://mcp.hubris.network/sse
+secrets_issuance_endpoint: https://secrets.hubris.network/issue