Keep the artifactapi UI/API split inside one HTTPRoute

Cross-route path precedence is untested on this Traefik gateway; the single
route already resolves /ui before / today.

- Fold the /ui and /oauth2 rules back into api-route on both listeners.
- Drop the separate ui-route and ui-http-redirect routes.

apps/base/artifactapi/httproute.yaml

@@ -1,6 +1,12 @@
 ---
-# API SIDE -- NOT AUTHENTICATED. Everything that is not /ui or /oauth2 lands
+# Path split between the authenticated UI and the unauthenticated machine API.
-# here and goes straight to the api Service, exactly as before:
+# Longest matching prefix wins, so the two UI rules take precedence over "/".
+#
+# AUTHENTICATED (oauth2 Service -> oauth2-proxy -> ui Service):
+#   /oauth2   oauth2-proxy sign_in / start / callback / sign_out
+#   /ui       the human-facing SPA
+#
+# NOT AUTHENTICATED (artifactapi Service, unchanged):
 #   /api/v1/{remote,local,virtual}/*   package proxy reads (yum/dnf, pip, ...)
 #   /api/v2/remotes|virtuals|locals/*  management API + the UI's own XHR calls
 #   /api/v2/remotes/{name}/files/*     CI publish uploads (PUT) and downloads
@@ -8,7 +14,7 @@
 #   /terraform/v1/providers/*          Terraform provider registry
 #   /.well-known/terraform.json        Terraform service discovery
 #   /health, /version, /               probes and the redirect to /ui/
-# These clients cannot complete a browser OIDC flow, so they must never be
+# Those clients cannot complete a browser OIDC flow, so they must never be
 # routed through oauth2-proxy.
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
@@ -33,33 +39,13 @@ spec:
     - backendRefs:
         - group: ""
           kind: Service
-          name: artifactapi
+          name: oauth2
           port: 80
           weight: 1
       matches:
         - path:
             type: PathPrefix
-            value: /
+            value: /oauth2
----
-# UI SIDE -- AUTHENTICATED. Only the human-facing SPA and the oauth2-proxy
-# endpoints (sign_in / start / callback / sign_out) go through the proxy, which
-# requires an Authentik session in akP-artifactapi-admin and forwards to the ui
-# Service. Longer path prefixes win over the api-route "/" rule above.
-# HTTPS only: the session cookie is Secure, so a plain-HTTP session cannot work.
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: ui-route
-  namespace: artifactapi
-spec:
-  hostnames:
-    - artifactapi.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: artifactapi
-      sectionName: https
-  rules:
     - backendRefs:
         - group: ""
           kind: Service
@@ -70,36 +56,13 @@ spec:
         - path:
             type: PathPrefix
             value: /ui
-        - path:
+    - backendRefs:
-            type: PathPrefix
+        - group: ""
-            value: /oauth2
+          kind: Service
----
+          name: artifactapi
-# Send plain-HTTP browsers hitting the UI to HTTPS so they can obtain the Secure
+          port: 80
-# session cookie. Scoped to the UI paths only -- api-route keeps serving the
+          weight: 1
-# package-manager surfaces over port 80 unredirected.
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: ui-http-redirect
-  namespace: artifactapi
-spec:
-  hostnames:
-    - artifactapi.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: artifactapi
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
       matches:
         - path:
             type: PathPrefix
-            value: /ui
+            value: /
-        - path:
-            type: PathPrefix
-            value: /oauth2