feat(oauth2-proxy): forward-auth ext_authz enforcement mechanism + group floor

Build the deferred forward-auth ENFORCEMENT for non-OIDC UIs (pihole/*arr/
qbittorrent/homepage; Crafty next), gated by Keycloak via oauth2-proxy.

- helmrelease: add `--allowed-groups=platform-admins` (R-IDP-06 floor:
  authenticated AND in group) + `--skip-provider-button` (302 straight to
  Keycloak; verified the interstitial 403 sign-in page otherwise).
- forward-auth-cec.yaml: interim self-authored CiliumClusterwideEnvoyConfig
  ext_authz listener -> oauth2-proxy /oauth2/auth, failure_mode_allow:false,
  per-route opt-in via virtualHost. TEMPLATE — not Flux-wired (PM deploys with
  an L2 VIP + DNS repoint). The ext_authz stanza is verified in-cluster.
- README: document the mechanism, why per-route ext_authz on the shared Gateway
  is NOT clean on Cilium 1.16.5 (machine-owned cilium-gateway-shared CEC; native
  ExternalAuth/GEP-1494 in no released Cilium), the three options + recommendation,
  the opt-in steps, the in-cluster proof, and the human browser test.

Keycloak `oauth2-proxy` client already carries the callback redirect URI + a
bare `groups` claim (full.path=false) — no realm change needed.

Proof (cilium-envoy v1.30.8): a standalone envoy running this exact ext_authz
stanza against the live oauth2-proxy denied unauthenticated requests (403,
oauth2-proxy sign-in body; upstream never served), while a no-filter control
route on the same backend returned 200. R-IDP-02 property holds.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/oauth2-proxy/helmrelease.yaml

@@ -46,13 +46,29 @@ spec:
       cookie-domain: ".home.keithjackson.dev"
       cookie-secure: "true"
       # Expose group membership so per-service group authorization (R-IDP-06) can be enforced. The
-      # baseline here is "authenticated"; per-service `--allowed-groups` is layered on at the Gateway
-      # ext-auth attachment (WS-NET contract) or via a dedicated oauth2-proxy instance per group.
+      # Keycloak `oauth2-proxy` client emits a `groups` claim (full.path=false => bare names like
+      # `platform-admins`, keycloak-realm-import.yaml). `--allowed-groups` below is the PLATFORM FLOOR:
+      # a valid Keycloak session is NOT enough — the user must ALSO be in `platform-admins`, or
+      # /oauth2/auth returns 403 and ext_authz denies (R-IDP-06). Every currently-onboarded
+      # forward-auth app (pihole, *arr, qbittorrent, homepage, prometheus, alertmanager, hubble)
+      # declares `groups: [platform-admins]` in its ServiceDefinition, so this floor matches them all.
+      # Per-ROUTE group differentiation (a future app allowing a different group) does NOT need a
+      # second proxy: the ext_authz filter appends `?allowed_groups=<group>` to /oauth2/auth from the
+      # HTTPRoute's `homelab.keithjackson.dev/auth-groups` annotation — oauth2-proxy honours the
+      # per-request query on top of this floor. See forward-auth-cec.yaml + README "opt-in".
       oidc-groups-claim: groups
+      allowed-groups: platform-admins    # R-IDP-06 floor: authenticated AND in platform-admins
+      # Single Keycloak provider => skip the oauth2-proxy interstitial "Sign In" button and 302
+      # straight to Keycloak. Verified in-cluster: WITHOUT this, an ext_authz-denied browser request
+      # gets oauth2-proxy's HTML sign-in page (HTTP 403) instead of an immediate redirect (docs/15 UX).
+      skip-provider-button: "true"
       scope: "openid email profile"
     # Metrics for the ServiceMonitor (../oauth2-proxy servicemonitor in platform-config).
     metrics:
       enabled: true
-    # TODO(WS-SEC/WS-NET, Phase 6): the Gateway ext-authz ATTACHMENT (which HTTPRoutes require this
-    #   proxy, and each route's allowed groups) is a WS-NET Gateway contract — Cilium Gateway API
-    #   ext-auth wiring. oauth2-proxy is the authenticator; the per-route enforcement is Gateway-side.
+    # ENFORCEMENT (Phase 6): oauth2-proxy is the AUTHENTICATOR; the per-route ext_authz ENFORCEMENT is
+    #   Gateway-side. On Cilium 1.16.5 the shared Gateway's Envoy config is a machine-owned, constantly
+    #   regenerated CiliumEnvoyConfig (`gateway/cilium-gateway-shared`) that CANNOT be injected into,
+    #   and native Gateway-API ExternalAuth (GEP-1494) ships in NO released Cilium version yet. The
+    #   enforcement mechanism + the three wiring options are documented in README.md; the interim
+    #   self-authored ext_authz listener is forward-auth-cec.yaml (a template, not yet Flux-wired).