edit(content): review batch-2 editorial pass across 24 posts (EN + ZH)

Tracker at 20 approved / 71 pending. Same pass as batch 1: first person throughout,
no LAN IPs in prose, ZH twins normalised to simplified Chinese, dynamicCta where the
post ends on a concrete next step.

src/content/posts/authentik-forward-auth-gate-wasnt-live.md

@@ -91,7 +91,7 @@ Here's why. My hostnames are served by **two** independent ingress paths:
 
 | Path | What serves it | Where it lands |
 |---|---|---|
-| Home IP → nginx (443) | the vhost I edited | the outpost ✅ |
+| Direct WAN IP → nginx (443) | the vhost I edited | the outpost ✅ |
 | Cloudflare Tunnel (`cloudflared`) | a rule inside the tunnel's own config | the app's port, directly ❌ |
 
 The tunnel's ingress is a small ordered list evaluated per hostname:
@@ -116,7 +116,7 @@ curl -s "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$T
 ```
 
 ```
-git.example.com   -> http://192.168.1.6:6880
+git.example.com   -> http://10.0.0.10:6880
 app.example.com   -> http://app-container:8080
 bot.example.com   -> http://bot-container:8080
 *                 -> http_status:404
@@ -238,7 +238,7 @@ If the answer isn't what your configuration says it should be, you're editing th
 
 If you need single sign-on in front of internal tools, a self-hosted app exposed safely to the internet, or someone to audit which ingress path is actually serving your domains, that's the work I do.
 
-- **WhatsApp:** [011-797 2969](https://wa.me/60127972969) — tap to chat
+- **WhatsApp:** [+60 12-797 2969](https://wa.me/60127972969) — tap to chat
 - **Email:** [[email protected]](mailto:[email protected]?subject=Reverse%20proxy%20%26%20SSO%20enquiry)
 - **Website:** [hoelee.com](https://www.hoelee.com)