feat(homepage): apex landing dashboard at home.keithjackson.dev

Deploy Homepage (gethomepage) as the apex landing dashboard aggregating
links to cluster services, in its OWN non-gating post-platform Flux
Kustomization (clusters/base/homepage.yaml, dependsOn platform-config,
wait:false) — mirrors headlamp/oauth2-proxy so a leaf UI can never gate
the platform chain.

- platform/homepage/: plain manifests (ns, config ConfigMap, Deployment,
  Service, default-deny+Cilium ingress NP, apex HTTPRoute). Non-root pod,
  HOMEPAGE_ALLOWED_HOSTS, bundled mdi-* icons (DNS-only egress).
- gateway.yaml: add https-apex + http-apex-redirect listeners for the bare
  apex (the *.home wildcard listener does NOT match it). Apex is already a
  SAN on the wildcard cert — no new Certificate.
- Forward-auth annotated (auth-mode=forward-auth) but NOT enforced: the
  Gateway ext-authz mechanism is an unbuilt Phase-6 WS-NET TODO (same status
  as all other forward-auth apps). Flagged as PM follow-up.

Gate: lint/l0/render-golden(10/10)/l1 green; conformance skipped (no cluster).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/gateway/gateway.yaml

@@ -37,6 +37,37 @@ spec:
           selector:
             matchLabels:
               gateway-access: "shared"
+    # APEX listeners. The wildcard listeners above match ONLY subdomains: `*.home.keithjackson.dev`
+    # does NOT intersect the bare apex `home.keithjackson.dev`, so an HTTPRoute for the apex host
+    # (the Homepage landing dashboard, clusters/base/homepage.yaml) would bind to NO listener and
+    # never serve. These two listeners give the apex its own hostname. TLS is the SAME wildcard cert:
+    # `home.keithjackson.dev` is already a SAN on wildcard-certificate.yaml, so `wildcard-home-tls`
+    # terminates the apex too — no extra Certificate needed. Same gateway-access=shared opt-in.
+    - name: https-apex
+      protocol: HTTPS
+      port: 443
+      hostname: "home.keithjackson.dev"
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - kind: Secret
+            name: wildcard-home-tls      # apex is a SAN on the wildcard cert (wildcard-certificate.yaml)
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              gateway-access: "shared"
+    - name: http-apex-redirect
+      protocol: HTTP
+      port: 80
+      hostname: "home.keithjackson.dev"
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              gateway-access: "shared"
 # TODO(WS-NET, Phase 2): pin the L2-announced VIP / IP pool; add HTTP->HTTPS redirect HTTPRoute;
 #   confirm cross-namespace ReferenceGrant pattern with WS-APPS. Ingress opens NORTH-SOUTH only —
 #   it does not relax east-west default-deny (docs/09).