Split authentik gateway into public wildcard + internal vault-issuer gateways

The single authentik Gateway kept cert-manager.io annotations (vault-issuer,
common-name identity.k8s.syd1.au.unkin.net) while its public identity.unkin.net
https listener referenced the reflector-managed wildcard-unkin-net-tls. The
cert-manager gateway-shim mints a Certificate per distinct listener secretName
from Gateway-level annotations, so it would create a competing vault-issuer
Certificate for wildcard-unkin-net-tls and fight the emberstack reflector over
that secret.

Split into two Gateways mirroring the cheeztv/fafflix convention:
- authentik (public): identity.unkin.net listeners on wildcard-unkin-net-tls,
  no cert-manager annotations, external-dns publishes identity.unkin.net.
- authentik-internal: identity.k8s.syd1.au.unkin.net listeners on authentik-tls
  with the vault-issuer cert-manager annotations, external-dns publishes the
  cluster host. Both target 198.18.200.4.

Update HTTPRoutes to attach each hostname's redirect + app route to the
matching gateway's http/https sections.

apps/base/authentik/httproute.yaml

@@ -7,16 +7,11 @@ metadata:
 spec:
   hostnames:
     - identity.unkin.net
-    - identity.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: authentik
       sectionName: http
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik
-      sectionName: http-internal
   rules:
     - filters:
         - type: RequestRedirect
@@ -36,16 +31,60 @@ metadata:
 spec:
   hostnames:
     - identity.unkin.net
-    - identity.k8s.syd1.au.unkin.net
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: authentik
       sectionName: https
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: authentik
-      sectionName: https-internal
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: authentik-server
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik-http-redirect-internal
+  namespace: authentik
+spec:
+  hostnames:
+    - identity.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-internal
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authentik-internal
+  namespace: authentik
+spec:
+  hostnames:
+    - identity.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: authentik-internal
+      sectionName: https
   rules:
     - backendRefs:
         - group: ""