fix(oauth2-proxy): --allowed-groups → --allowed-group (correct oauth2-proxy v7.8.1 flag)

The plural --allowed-groups does not exist in oauth2-proxy v7.8.1; the shared
oauth2-proxy new pod and the crafty auth sidecar both crashlooped on 'unknown flag'.
The flag is the singular, repeatable --allowed-group.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/crafty/deployment.yaml

@@ -135,7 +135,7 @@ spec:
             - --oidc-groups-claim=groups
             # R-IDP-06: a valid Keycloak session is NOT enough — the user must ALSO be in platform-admins,
             # else /oauth2 returns 403. (Matches the platform oauth2-proxy floor.)
-            - --allowed-groups=platform-admins
+            - --allowed-group=platform-admins
             # Single provider => 302 straight to Keycloak, no oauth2-proxy interstitial button.
             - --skip-provider-button=true
             - --redirect-url=https://crafty.home.keithjackson.dev/oauth2/callback

platform/oauth2-proxy/helmrelease.yaml

@@ -57,7 +57,7 @@ spec:
       # HTTPRoute's `homelab.keithjackson.dev/auth-groups` annotation — oauth2-proxy honours the
       # per-request query on top of this floor. See forward-auth-cec.yaml + README "opt-in".
       oidc-groups-claim: groups
-      allowed-groups: platform-admins    # R-IDP-06 floor: authenticated AND in platform-admins
+      allowed-group: platform-admins    # R-IDP-06 floor: authenticated AND in platform-admins (oauth2-proxy flag is singular --allowed-group, repeatable)
       # Single Keycloak provider => skip the oauth2-proxy interstitial "Sign In" button and 302
       # straight to Keycloak. Verified in-cluster: WITHOUT this, an ext_authz-denied browser request
       # gets oauth2-proxy's HTML sign-in page (HTTP 403) instead of an immediate redirect (docs/15 UX).