Move public identity gateway to external traefik proxy

The public authentik gateway (identity.unkin.net) now uses traefik-external
and removes external-dns management, matching the arrproxy external gateway
convention. DNS remains managed out-of-band via bind-operator. The internal
authentik-internal gateway stays on traefik-internal.

apps/base/authentik/gateway.yaml

@@ -1,23 +1,22 @@
 ---
-# Public identity.unkin.net listener. external-dns publishes the A record at the
+# External (DMZ) front for public identity.unkin.net, served via the external
-# internal LB VIP (198.18.200.4). Public TLS is terminated with the real Let's
+# Traefik (LB VIP 198.18.199.0). The apex identity.unkin.net A record lives in
-# Encrypt *.unkin.net wildcard, centrally minted once in the cert-manager
+# the bind-operator unkin.net zone (bind-internal/authoritative), NOT
-# namespace (Certificate wildcard-unkin-net) and reflected into this namespace
+# external-dns, so no external-dns annotation here. Public TLS is terminated with
-# by the emberstack reflector as the secret wildcard-unkin-net-tls. No
+# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
-# cert-manager annotations here so the gateway-shim does not mint a competing
+# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
-# Vault-PKI Certificate for the reflected secret.
+# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
   labels:
-    traefik.io/instance: internal
+    traefik.io/instance: external
   annotations:
-    external-dns.alpha.kubernetes.io/hostname: identity.unkin.net
+    argocd.argoproj.io/sync-wave: "2"
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
   name: authentik
   namespace: authentik
 spec:
-  gatewayClassName: traefik-internal
+  gatewayClassName: traefik-external
   listeners:
     - allowedRoutes:
         namespaces: