feat(auth): gate pihole UI with per-app oauth2-proxy sidecar (canary)

Close the un-gated-UI security finding for forward-auth apps (R-IDP-02) by
rendering the Option-B per-app oauth2-proxy reverse-proxy sidecar that crafty
proves working. catalog/render.py now emits, for any forward-auth app with an
exposed UI: the oauth2-proxy sidecar (upstream http://127.0.0.1:<uiport>,
:4180, --allowed-group per auth.group), an authproxy :4180 Service port, an
HTTPRoute backendRef -> :4180, and a gateway-ingress CiliumNetworkPolicy that
allows the Gateway to reach ONLY :4180 (fail-closed: the bare UI is never
served un-authenticated). oidc/native/none apps render byte-identical.

This is the CANARY: only pihole's golden carries the sidecar and is verified
fail-closed in-cluster first. jackett/qbittorrent/radarr/sonarr are deferred to
the rollout commit (temporarily listed in ci/render-golden.sh) so their UIs
keep serving exactly as today until their clients+secrets land.

- keycloak: confidential pihole client (realm-import + realm-clients mirror),
  provisioned live via kcadm (groups membership mapper, bare names).
- secret: SOPS/age pihole-oauth2-proxy-credentials (client-id/secret/cookie),
  wired into apps/wave-0 via the renderer's new sidecar-creds wave rule.
- L1 render goldens regenerated for the sidecar (forward-auth fixtures).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

ci/render-golden.sh

@@ -39,7 +39,15 @@ PYTHON="${PYTHON:-python3}"
 # DESIGN-waves.md §"Catalog services not yet onboarded"). They render as a
 # by-product of `--all catalog` but must NOT have a golden; the gate ignores
 # their rendered output. Onboarding one = add its golden and drop it here.
-: "${RENDER_GOLDEN_NOT_ONBOARDED:=keycloak vm-demo}"
+#
+# CANARY DEFERRAL (forward-auth oauth2-proxy sidecar rollout, 2026-08-31): the renderer now
+# emits a per-app oauth2-proxy sidecar for every forward-auth app (pihole/jackett/qbittorrent/
+# radarr/sonarr). pihole is the CANARY — its golden carries the sidecar and is verified fail-closed
+# in-cluster FIRST. The other four are deferred to the ROLLOUT commit so partial progress is safe
+# (their committed goldens stay sidecar-less and keep serving exactly as today). They are listed
+# here TEMPORARILY so the canonical render's fresh (sidecar) output does not flag drift against the
+# deferred sidecar-less goldens. The ROLLOUT commit re-renders their goldens and REMOVES them here.
+: "${RENDER_GOLDEN_NOT_ONBOARDED:=keycloak vm-demo jackett qbittorrent radarr sonarr}"
 
 log "Stage: render==golden reproducibility (canonical render vs committed apps/)"