platform: deploy Headlamp dashboard with Keycloak OIDC + per-user RBAC

Add Headlamp (kubernetes-sigs/headlamp Helm chart) at
headlamp.home.keithjackson.dev with native Keycloak OIDC login and PER-USER
RBAC: Headlamp forwards each user's id_token to the k3s apiserver, so the
existing oidc:* group bindings (platform-admins->cluster-admin, viewers->view)
apply per user. The ServiceAccount is deliberately NOT bound to cluster-admin
(clusterRoleBinding.create=false), since user requests ride the forwarded token.

Key integration nuance: the apiserver is configured oidc-client-id=kubernetes,
so it only accepts tokens whose aud contains `kubernetes`. The new `headlamp`
Keycloak client carries an oidc-audience-mapper (included.client.audience=
kubernetes) so tokens carry aud=[headlamp, kubernetes] -- accepted by both
Headlamp's own verifier and the apiserver, leaving the apiserver config
untouched. A groups mapper emits the `groups` claim the apiserver maps to RBAC.

- platform/headlamp: namespace, HelmRepository/HelmRelease, SOPS OIDC secret
  (externalSecret envFrom), default-deny NetworkPolicy + Cilium ingress
  (gateway)/egress (apiserver+Keycloak) policies, README. Wired into
  platform/kustomization.yaml (platform tier).
- platform/headlamp/httproute.yaml wired into platform-config (Gateway API CR,
  dependsOn platform), modeled on grafana-httproute.
- keycloak-realm-import: add `headlamp` confidential client + groups/audience
  mappers + HEADLAMP_CLIENT_SECRET placeholder. Client also created LIVE via
  kcadm (realm import no-ops on the existing realm).
- keycloak-realm-clients.sops: add headlamp-client-secret (mirrored into
  headlamp-oidc-credentials clientSecret). Both encrypted to the repo age key.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/headlamp/httproute.yaml

@@ -0,0 +1,35 @@
+---
+# North-south ingress for Headlamp at headlamp.home.keithjackson.dev. Attaches to the shared Gateway
+# (docs/09); TLS terminated at the Gateway by the *.home.keithjackson.dev wildcard cert (already
+# covers this host). Same-namespace backend, so no ReferenceGrant is needed; the parentRef is
+# permitted because the headlamp namespace carries gateway-access=shared. CR of the Gateway API CRDs
+# — CARRIED BY platform-config (dependsOn platform) so the CRDs exist first (like grafana-httproute).
+#
+# auth-mode annotation records that Headlamp authenticates via native Keycloak OIDC (R-IDP-02); this
+# route is NOT protected by oauth2-proxy forward-auth (Headlamp runs its own OIDC login + per-user
+# token forwarding), so it must NOT carry an oauth2-proxy ExtAuth filter.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: headlamp
+  namespace: headlamp
+  labels:
+    app.kubernetes.io/name: headlamp
+  annotations:
+    homelab.keithjackson.dev/auth-mode: oidc
+    homelab.keithjackson.dev/auth-groups: platform-admins
+spec:
+  parentRefs:
+    - name: shared
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - headlamp.home.keithjackson.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: headlamp
+          port: 80