Point app_url at the bare domain and publish the broker host

app_url advertised https://app.<domain>, which has never had a DNS record —
the frontend is served on the bare domain by Caddy. Adds mqtt_host so the
broker endpoint nodes connect to is discoverable from terraform output.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

infra/outputs.tf

@@ -3,12 +3,22 @@ output "server_ip" {
   description = "Static external IP of the DRB server VM"
 }
 
+# Bare domain, not app.<domain> — the frontend is served on the domain itself
+# (see infra/ansible/roles/deploy/templates/Caddyfile.j2). Only the bare name,
+# api. and mqtt. have DNS records; app. has never resolved.
 output "app_url" {
-  value = "https://app.${var.domain}"
+  value       = "https://${var.domain}"
+  description = "Frontend / portal URL"
 }
 
 output "api_url" {
-  value = "https://api.${var.domain}"
+  value       = "https://api.${var.domain}"
+  description = "c2-core REST API URL"
+}
+
+output "mqtt_host" {
+  value       = "mqtt.${var.domain}"
+  description = "Broker hostname edge nodes connect to on TCP 8883 (TLS)"
 }
 
 output "project_number" {