watchstate: expose externally at watchstate.unkin.net

Add a public front door for the WatchState admin UI on watchstate.unkin.net
via the external (DMZ) Traefik, alongside the existing internal
watchstate.k8s.syd1.au.unkin.net gateway. oauth2-proxy fronts both hostnames.

- DNSRecord watchstate-dns-internal (bind-internal/authoritative, unkin.net
  zone) -> A 198.18.199.0, the traefik-external VIP (arrstack precedent).
- watchstate-external Gateway (traefik-external) + HTTPRoutes: http->https
  redirect and https -> watchstate-oauth2:80. TLS terminated with the
  Let's Encrypt *.unkin.net wildcard (wildcard-unkin-net-tls), so no
  cert-manager/external-dns annotations.
- oauth2-proxy: relative redirect-url (/oauth2/callback) so reverse-proxy mode
  derives scheme+host per request, making the callback work on BOTH hosts;
  cookie + whitelist domains cover both hostnames.
- Drop the no-op sync-wave: "0" annotation on the vaultauth default VaultAuth.

Dependencies:
- wildcard-unkin-net-tls reflection into the watchstate namespace (reflector
  allow-list, argocd-apps PR #418).
- Both callback URIs registered on the Authentik watchstate provider
  (terraform-authentik, separate PR).

apps/base/watchstate/httproute-external.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: watchstate-external-http-redirect
+  namespace: watchstate
+spec:
+  hostnames:
+    - watchstate.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: watchstate-external
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: watchstate-external
+  namespace: watchstate
+spec:
+  hostnames:
+    - watchstate.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: watchstate-external
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: watchstate-oauth2
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /