fix(flux): move oauth2-proxy to a post-platform tier (dependsOn platform-config)

oauth2-proxy is a leaf forward-auth service that depends on Keycloak +
trusted wildcard TLS + split-horizon DNS. It lived in the gating `platform`
Flux Kustomization (wait:true), so on a cold start it Failed until those
dependencies existed, keeping the whole `platform` tier not-Ready. That in
turn blocked `platform-config` — which brings up the very Keycloak instance,
wildcard Certificate and L2 VIP oauth2-proxy needs (and previously carried
oauth2-proxy's own httproute/servicemonitor) — from ever reconciling. A
self-gating cold-start deadlock, twice-proven (DECISIONS-LOG sessions 7 & 9).

Break the cycle by moving the whole oauth2-proxy component out of the
`platform` tier into its own non-gating post-platform Flux Kustomization:

- clusters/base/oauth2-proxy.yaml: new Kustomization -> ./platform/oauth2-proxy,
  dependsOn platform-config, wait:false, substituteFrom cluster-vars.
- clusters/base/kustomization.yaml: reference the new Kustomization.
- platform/kustomization.yaml: drop the oauth2-proxy component (no longer in
  the gating tier).
- platform/oauth2-proxy/kustomization.yaml: pull in httproute + servicemonitor
  so the full component travels together.
- platform-config/kustomization.yaml: drop the in-place oauth2-proxy
  httproute/servicemonitor refs (moved with the controller).
- clusters/dev/kustomization.yaml: add the SOPS decryption patch for the new
  oauth2-proxy Kustomization (it now owns the encrypted credentials Secret that
  the `platform` Kustomization used to decrypt).

Now `platform` reaches Ready without oauth2-proxy; platform-config brings up
Keycloak/TLS/DNS; then oauth2-proxy reconciles against dependencies that
already exist. wait:false guarantees its health can never gate anything above
it. No config of oauth2-proxy itself changed — only its reconciliation tier.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kustomization.yaml

@@ -26,12 +26,14 @@ resources:
   # ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
   - monitoring         # kube-prometheus-stack + Loki + Alloy + Alertmanager
   # ---- Phase 6 — Identity / SSO (ADR-0014): foundational IdP, onboarded early. Keycloak Operator +
-  #      CloudNativePG DB + oauth2-proxy forward-auth. Controllers here; the Keycloak/RealmImport/CNPG
-  #      Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ----
+  #      CloudNativePG DB. Controllers here; the Keycloak/RealmImport/CNPG Cluster CRs + ServiceMonitors
+  #      + HTTPRoutes are in platform-config (dependsOn platform). ----
+  #      oauth2-proxy (forward-auth) is DELIBERATELY NOT here: it depends on Keycloak + trusted TLS +
+  #      split-horizon DNS, so keeping it in this wait:true tier self-gated its own dependencies into a
+  #      cold-start deadlock (twice). It now reconciles in its own post-platform Flux Kustomization
+  #      (clusters/base/oauth2-proxy.yaml, dependsOn platform-config). See DECISIONS-LOG.
   - cnpg               # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
   - keycloak           # Keycloak Operator (quay.io images) + SOPS admin credential
-  - oauth2-proxy       # forward-auth for non-OIDC apps (ADR-0014); OIDC-discovers Keycloak (now live)
-                       # via the split-horizon VIP (GATEWAY_VIP 192.168.1.53) — pre-verified in-cluster.
   # ---- Later phases: enabled when their phase opens ----
   # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
   # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate

platform/oauth2-proxy/kustomization.yaml

@@ -1,4 +1,10 @@
 ---
+# oauth2-proxy component. Rendered by its OWN post-platform Flux Kustomization
+# (clusters/base/oauth2-proxy.yaml, dependsOn platform-config, wait:false) — NOT by the gating
+# `platform` tier. The httproute + servicemonitor (Gateway API / monitoring CRs) travel WITH the
+# controller here now, rather than being referenced in-place from platform-config: the CRDs they
+# need (gateway.networking.k8s.io, monitoring.coreos.com) are registered by platform and platform
+# is Ready before this tier's platform-config dependency completes, so ordering holds.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
@@ -6,3 +12,5 @@ resources:
   - helmrepository.yaml
   - helmrelease.yaml
   - oauth2-proxy-credentials.sops.yaml
+  - httproute.yaml       # forward-auth sign-in/callback ingress (was referenced in-place by platform-config)
+  - servicemonitor.yaml  # Prometheus scrape (was referenced in-place by platform-config)