Stop teaching a group naming convention that will not match

[ChrisonSimtian]

A teammate session working on the Homelab repo flagged that its eight access groups were renamed to lowercase-hyphenated forms (Homelab Admins → homelab-admins), because a group name travels inside the groups claim and consumers re-split it with their own rules — Pulse splits on whitespace and commas, so Homelab Admins arrived as two tokens and matched nothing, failing closed with no message.

Krautwatch's blueprint entry is unaffected (it references blueprint entry ids via !KeyOf, which did not change), but the documentation here was wrong twice over:

1. It put one homelab's specific group names into generic self-hosting docs.
2. Those names no longer exist, so anyone copying them would get a deployment that authenticates fine and then admits nobody — the worst shape of failure, since the sign-in succeeds and the refusal looks like a permissions bug.

Now neutral examples, plus the thing that actually matters: the names must be exactly what your provider emits in the claim. Also documented that Krautwatch splits the list on commas only — so a name with a space works here — while noting that other consumers of the same claim split on whitespace, which is why hyphenated names travel better. That is a nudge, not a rule we enforce: forcing our parser to split on whitespace would break legitimate names like Domain Admins for everyone else.

No behaviour change; ./build.sh Test green.