Put the artifactapi web UI behind Authentik oauth2-proxy

Front /ui with an Authentik-authenticated oauth2-proxy while leaving every
package-manager surface unauthenticated.

- Add the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape.
- Add the oauth-credentials VaultStaticSecret.
- Split httproute: /ui and /oauth2 to oauth2-proxy (HTTPS, plus an HTTP
  redirect); everything else to the api Service on both listeners.

apps/base/artifactapi/httproute.yaml

@@ -1,4 +1,15 @@
 ---
+# API SIDE -- NOT AUTHENTICATED. Everything that is not /ui or /oauth2 lands
+# here and goes straight to the api Service, exactly as before:
+#   /api/v1/{remote,local,virtual}/*   package proxy reads (yum/dnf, pip, ...)
+#   /api/v2/remotes|virtuals|locals/*  management API + the UI's own XHR calls
+#   /api/v2/remotes/{name}/files/*     CI publish uploads (PUT) and downloads
+#   /v2/*                              Docker Registry V2 (containerd, buildah)
+#   /terraform/v1/providers/*          Terraform provider registry
+#   /.well-known/terraform.json        Terraform service discovery
+#   /health, /version, /               probes and the redirect to /ui/
+# These clients cannot complete a browser OIDC flow, so they must never be
+# routed through oauth2-proxy.
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -19,16 +30,6 @@ spec:
       name: artifactapi
       sectionName: https
   rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: ui
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /ui
     - backendRefs:
         - group: ""
           kind: Service
@@ -39,3 +40,66 @@ spec:
         - path:
             type: PathPrefix
             value: /
+---
+# UI SIDE -- AUTHENTICATED. Only the human-facing SPA and the oauth2-proxy
+# endpoints (sign_in / start / callback / sign_out) go through the proxy, which
+# requires an Authentik session in akP-artifactapi-admin and forwards to the ui
+# Service. Longer path prefixes win over the api-route "/" rule above.
+# HTTPS only: the session cookie is Secure, so a plain-HTTP session cannot work.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ui-route
+  namespace: artifactapi
+spec:
+  hostnames:
+    - artifactapi.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: artifactapi
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: oauth2
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /ui
+        - path:
+            type: PathPrefix
+            value: /oauth2
+---
+# Send plain-HTTP browsers hitting the UI to HTTPS so they can obtain the Secure
+# session cookie. Scoped to the UI paths only -- api-route keeps serving the
+# package-manager surfaces over port 80 unredirected.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ui-http-redirect
+  namespace: artifactapi
+spec:
+  hostnames:
+    - artifactapi.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: artifactapi
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /ui
+        - path:
+            type: PathPrefix
+            value: /oauth2