Revert "Put the artifactapi web UI behind Authentik oauth2-proxy (#456)"

This reverts commit c98d88c197.

The artifactapi web UI has been down since #456 merged: /ui/ and /oauth2/
both return 503 "no available server", Traefik's response for a Service
with no ready endpoints, so the oauth2-proxy pod is not becoming ready.
The machine API surface (/version, /api/v2/health, /v2/,
/.well-known/terraform.json) is unaffected and still returns 200.

Rolling back restores unauthenticated access to the UI at /ui, served
directly by the ui Service exactly as before.

- Point the api-route /ui rule back at the ui Service and drop the
  /oauth2 rule.
- Remove the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape.
- Remove the oauth-credentials VaultStaticSecret.

The apps/base/artifactapi tree is byte-identical to 520da44, the commit
immediately before #456. Nothing that landed since is touched.

apps/base/artifactapi/httproute.yaml

@@ -1,21 +1,4 @@
 ---
-# Path split between the authenticated UI and the unauthenticated machine API.
-# Longest matching prefix wins, so the two UI rules take precedence over "/".
-#
-# AUTHENTICATED (oauth2 Service -> oauth2-proxy -> ui Service):
-#   /oauth2   oauth2-proxy sign_in / start / callback / sign_out
-#   /ui       the human-facing SPA
-#
-# NOT AUTHENTICATED (artifactapi Service, unchanged):
-#   /api/v1/{remote,local,virtual}/*   package proxy reads (yum/dnf, pip, ...)
-#   /api/v2/remotes|virtuals|locals/*  management API + the UI's own XHR calls
-#   /api/v2/remotes/{name}/files/*     CI publish uploads (PUT) and downloads
-#   /v2/*                              Docker Registry V2 (containerd, buildah)
-#   /terraform/v1/providers/*          Terraform provider registry
-#   /.well-known/terraform.json        Terraform service discovery
-#   /health, /version, /               probes and the redirect to /ui/
-# Those clients cannot complete a browser OIDC flow, so they must never be
-# routed through oauth2-proxy.
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -39,17 +22,7 @@ spec:
     - backendRefs:
         - group: ""
           kind: Service
-          name: oauth2
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /oauth2
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: oauth2
+          name: ui
           port: 80
           weight: 1
       matches: