WIP keycloak stack (gate probe)

platform/oauth2-proxy/namespace.yaml

@@ -3,3 +3,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: oauth2-proxy
+  labels:
+    # Opt in to the shared Gateway so oauth2-proxy's sign-in/callback endpoint is reachable at
+    # auth.home.keithjackson.dev (docs/09). Platform component — NOT app-namespace (see keycloak ns note).
+    gateway-access: "shared"