feat(auth): gate jackett/qbittorrent/radarr/sonarr UIs with oauth2-proxy sidecar (rollout)

Roll the verified Option-B per-app oauth2-proxy sidecar out to the remaining
four forward-auth apps after the pihole canary was confirmed fail-closed
(unauthenticated -> 302 to Keycloak, pod 2/2, clean sidecar OIDC discovery).

Each app's Gateway route now terminates at its oauth2-proxy sidecar (:4180,
--allowed-group=media-users, --upstream=http://127.0.0.1:<uiport>); the
gateway-ingress CiliumNetworkPolicy allows the Gateway to reach ONLY :4180, so
the bare UI is never served un-authenticated (fail-closed; R-IDP-02/06). The
apps' own app/API ports stay in-Service for EAST-WEST callers (arr ->
qbittorrent:8080 / jackett:9117) via the existing reciprocal-ingress allows.

- keycloak: confidential jackett/qbittorrent/radarr/sonarr clients (realm-import
  + realm-clients mirror), provisioned live via kcadm (groups membership mapper).
- secrets: four SOPS/age <app>-oauth2-proxy-credentials, wired into apps/wave-0
  and apps/wave-1 by the renderer's sidecar-creds wave rule.
- ci: remove the temporary canary deferral (all five goldens now reproduce).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/wave-1/sonarr.yaml

@@ -84,6 +84,70 @@ spec:
         volumeMounts:
         - name: config
           mountPath: /data/config
+      - name: oauth2-proxy
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.1
+        imagePullPolicy: IfNotPresent
+        args:
+        - --http-address=0.0.0.0:4180
+        - --reverse-proxy=true
+        - --provider=oidc
+        - --oidc-issuer-url=https://keycloak.home.keithjackson.dev/realms/homelab
+        - --upstream=http://127.0.0.1:8989
+        - --email-domain=*
+        - --scope=openid email profile
+        - --oidc-groups-claim=groups
+        - --allowed-group=media-users
+        - --skip-provider-button=true
+        - --redirect-url=https://sonarr.home.keithjackson.dev/oauth2/callback
+        - --cookie-domain=.home.keithjackson.dev
+        - --whitelist-domain=.home.keithjackson.dev
+        - --cookie-secure=true
+        - --pass-access-token=true
+        - --set-xauthrequest=true
+        env:
+        - name: OAUTH2_PROXY_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: sonarr-oauth2-proxy
+              key: client-id
+        - name: OAUTH2_PROXY_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: sonarr-oauth2-proxy
+              key: client-secret
+        - name: OAUTH2_PROXY_COOKIE_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: sonarr-oauth2-proxy
+              key: cookie-secret
+        ports:
+        - name: http
+          containerPort: 4180
+          protocol: TCP
+        resources:
+          requests:
+            cpu: 25m
+            memory: 64Mi
+          limits:
+            memory: 128Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        livenessProbe:
+          httpGet:
+            path: /ping
+            port: http
+          initialDelaySeconds: 5
+          periodSeconds: 15
+        readinessProbe:
+          httpGet:
+            path: /ping
+            port: http
+          initialDelaySeconds: 5
+          periodSeconds: 15
       volumes:
       - name: config
         persistentVolumeClaim:
@@ -104,6 +168,9 @@ spec:
   - name: port-8989
     port: 8989
     targetPort: 8989
+  - name: authproxy
+    port: 4180
+    targetPort: 4180
 ---
 # CiliumNetworkPolicy egress allow (R-NET-02): sonarr-allow-qbittorrent-8080
 apiVersion: cilium.io/v2
@@ -188,7 +255,7 @@ spec:
     - ingress
     toPorts:
     - ports:
-      - port: '8989'
+      - port: '4180'
         protocol: TCP
 ---
 # CiliumNetworkPolicy world egress allow (egress class governs the path; R-NET-05): sonarr-allow-internet-egress
@@ -236,7 +303,7 @@ spec:
         value: /
     backendRefs:
     - name: sonarr
-      port: 8989
+      port: 4180
 ---
 # ServiceMonitor (R-OBS-01)
 apiVersion: monitoring.coreos.com/v1