Put the artifactapi web UI behind Authentik oauth2-proxy

Front /ui with an Authentik-authenticated oauth2-proxy while leaving every
package-manager surface unauthenticated.

- Add the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape.
- Add the oauth-credentials VaultStaticSecret.
- Split httproute: /ui and /oauth2 to oauth2-proxy (HTTPS, plus an HTTP
  redirect); everything else to the api Service on both listeners.

apps/base/artifactapi/services.yaml

@@ -16,6 +16,26 @@ spec:
   sessionAffinity: None
   type: ClusterIP
 ---
+# Authenticated front door for the web UI only: the ui-route HTTPRoute sends
+# /ui and /oauth2 here, oauth2-proxy authenticates and forwards to the ui
+# Service. The api Service above is reached directly and stays unauthenticated.
+apiVersion: v1
+kind: Service
+metadata:
+  name: oauth2
+  namespace: artifactapi
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: oauth2
+  sessionAffinity: None
+  type: ClusterIP
+---
 apiVersion: v1
 kind: Service
 metadata: