docs(runbooks): forward-auth IS enforced — correct the posture note

The serving route's comment claimed that because no Gateway ext-authz
attachment exists, every forward-auth route is 'in practice reachable
unauthenticated today'. That is wrong, and wrong in a dangerous direction
for a document an operator reads during an incident.

Enforcement here is PER-POD, not gateway-level: each of the five services
declaring auth: forward-auth (pihole, jackett, qbittorrent, radarr, sonarr)
publishes both its app port and 4180 on its Service, and its HTTPRoute
targets :4180 — the oauth2-proxy sidecar. Verified on prod. The app port
remains reachable in-cluster on purpose, which is how sonarr/radarr drive
qBittorrent's API, and Cilium default-deny governs that path.

The public-by-design decision for this route is unchanged and still correct;
what changes is that it is genuinely the exception rather than one open route
among many. Headlamp's exclusion is likewise deliberate (native OIDC with
per-user id_token forwarding and no ServiceAccount cluster rights).

Co-Authored-By: Claude Opus 5 <[email protected]>

runbooks/README.md

@@ -127,13 +127,16 @@ the 404 it replaced — it looks fixed.
 
 ## Why this route has no login
 
-Deliberately public. Every other exposed UI here declares forward-auth via oauth2-proxy → Keycloak; if
+Deliberately public. The UIs that declare forward-auth (pihole, jackett, qbittorrent, radarr, sonarr)
+really are closed: enforcement is per-pod, each one's HTTPRoute targeting its oauth2-proxy sidecar on
+:4180 rather than the app port. If
 these pages did too, `keycloak-down` would be unreadable exactly when Keycloak is down,
 `keycloak-db` unreadable when its database is down, and `keycloak-client-secrets` unreadable during the
 precise failure that broke all 12 OIDC clients on 2026-09-06 behind an entirely green cluster. An
 operator who cannot log in is this route's primary reader. The content is operational procedure — metric
 names, thresholds, kubectl invocations, topology — and no secrets. See
-`runbooks/serving/httproute.yaml` for the full reasoning, including the instruction to leave this route
-**out** of the Gateway ext-authz attachment when forward-auth enforcement lands.
+`runbooks/serving/httproute.yaml` for the full reasoning, including how forward-auth is actually
+enforced here and the instruction to leave this route **out** of any Gateway-level ext-authz attachment
+if one is ever introduced.
 
 The running narrative of real incidents on this cluster is `DECISIONS-LOG.md`.