feat(homepage): apex landing dashboard at home.keithjackson.dev

Deploy Homepage (gethomepage) as the apex landing dashboard aggregating
links to cluster services, in its OWN non-gating post-platform Flux
Kustomization (clusters/base/homepage.yaml, dependsOn platform-config,
wait:false) — mirrors headlamp/oauth2-proxy so a leaf UI can never gate
the platform chain.

- platform/homepage/: plain manifests (ns, config ConfigMap, Deployment,
  Service, default-deny+Cilium ingress NP, apex HTTPRoute). Non-root pod,
  HOMEPAGE_ALLOWED_HOSTS, bundled mdi-* icons (DNS-only egress).
- gateway.yaml: add https-apex + http-apex-redirect listeners for the bare
  apex (the *.home wildcard listener does NOT match it). Apex is already a
  SAN on the wildcard cert — no new Certificate.
- Forward-auth annotated (auth-mode=forward-auth) but NOT enforced: the
  Gateway ext-authz mechanism is an unbuilt Phase-6 WS-NET TODO (same status
  as all other forward-auth apps). Flagged as PM follow-up.

Gate: lint/l0/render-golden(10/10)/l1 green; conformance skipped (no cluster).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/homepage/httproute.yaml

@@ -0,0 +1,39 @@
+---
+# North-south ingress for Homepage at the APEX home.keithjackson.dev. Attaches to the shared Gateway
+# via the dedicated `https-apex` listener (sectionName) — the wildcard `https` listener's hostname
+# `*.home.keithjackson.dev` does NOT match the bare apex, so this route MUST bind the apex listener
+# added in platform/gateway/gateway.yaml. TLS is terminated at the Gateway by the wildcard cert (the
+# apex is a SAN on it). Same-namespace backend, so no ReferenceGrant; the parentRef is permitted
+# because the homepage namespace carries gateway-access=shared.
+#
+# auth-mode=forward-auth records the INTENDED posture: Homepage is a bare UI with no native OIDC, so
+# it should sit behind oauth2-proxy forward-auth at the Gateway (R-IDP-02). NOTE: the Gateway
+# ext-authz ATTACHMENT that actually enforces forward-auth is a Phase-6 WS-NET TODO that is NOT yet
+# built anywhere in the repo (platform/oauth2-proxy is the authenticator only; no CiliumEnvoyConfig /
+# ext-authz exists). Until that mechanism lands, this route — like every other forward-auth app
+# (jackett, qbittorrent, pihole, radarr, …) — is reachable without auth. See README.md "Forward-auth".
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: homepage
+  namespace: homepage
+  labels:
+    app.kubernetes.io/name: homepage
+  annotations:
+    homelab.keithjackson.dev/auth-mode: forward-auth
+    homelab.keithjackson.dev/auth-groups: platform-admins
+spec:
+  parentRefs:
+    - name: shared
+      namespace: gateway
+      sectionName: https-apex     # the apex listener (wildcard `https` won't match the bare apex)
+  hostnames:
+    - home.keithjackson.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: homepage
+          port: 80