itlab tofu exposure test

host: itlab-webtest

served via shared hub LB + managed Let's Encrypt cert (tofu-managed)