fix(oauth2-proxy): --allowed-groups → --allowed-group (correct oauth2-proxy v7.8.1 flag)

The plural --allowed-groups does not exist in oauth2-proxy v7.8.1; the shared
oauth2-proxy new pod and the crafty auth sidecar both crashlooped on 'unknown flag'.
The flag is the singular, repeatable --allowed-group.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/crafty/deployment.yaml

@@ -135,7 +135,7 @@ spec:
             - --oidc-groups-claim=groups
             # R-IDP-06: a valid Keycloak session is NOT enough — the user must ALSO be in platform-admins,
             # else /oauth2 returns 403. (Matches the platform oauth2-proxy floor.)
-            - --allowed-groups=platform-admins
+            - --allowed-group=platform-admins
             # Single provider => 302 straight to Keycloak, no oauth2-proxy interstitial button.
             - --skip-provider-button=true
             - --redirect-url=https://crafty.home.keithjackson.dev/oauth2/callback