config: drop concrete IP from egress allowlist; docs: fix host reference

- configs/tunnel.yaml: replace hardcoded address with wildcard
  *.projectshitpost.fun:8443 (covers both edge nodes)
- internal/tunnel/tunnel_test.go: use TEST-NET-1 (RFC 5737) IP
  192.0.2.10 instead of a real one
- docs/AUTH.md: token issue command now runs on stats host

configs/tunnel.yaml

@@ -1,6 +1,5 @@
 egress:
   allowed:
-    - "192.0.2.10:8443"          # FL xray inbound (production)
-    - "*.projectshitpost.fun:443" # any subdomain HTTPS
-    # TODO: add PL1 IP:port once confirmed (controller to fill in during deploy)
+    - "*.projectshitpost.fun:443"
+    - "*.projectshitpost.fun:8443"
   rate_mbps: 50

docs/AUTH.md

@@ -11,7 +11,7 @@ Bearer JWT (HS256), HMAC signing secret в `/etc/stats-gateway/jwt.key`.
 
 ## Выпуск нового токена
 
-На gitea-узле от пользователя с доступом к `jwt.key`:
+На stats-узле от пользователя с доступом к `jwt.key`:
 
     sudo -u stats /usr/local/bin/stats-issue-token --sub <client-id> --days <N>