flux: re-enable oauth2-proxy now Keycloak is live and split-horizon DNS points at 192.168.1.53

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kustomization.yaml

@@ -29,13 +29,8 @@ resources:
   #      Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ----
   - cnpg               # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
   - keycloak           # Keycloak Operator (quay.io images) + SOPS admin credential
-  # - oauth2-proxy     # TEMP-DISABLED (cold-start deadlock): oauth2-proxy OIDC-discovers Keycloak,
-  #                    # which lives in platform-config (dependsOn platform) — so it crashloops and
-  #                    # gates platform Ready on a fresh cluster. Re-enable AFTER platform-config is
-  #                    # green (Keycloak live). Proper fix = move to a post-platform-config tier
-  #                    # (DECISIONS-LOG oauth2-proxy FOLLOW-UP).
-  # FOLLOW-UP: move oauth2-proxy to a post-platform tier (dependsOn platform-config) so it can never
-  # block its own dependencies (cert-manager/gateway) from reconciling — see DECISIONS-LOG.
+  - oauth2-proxy       # forward-auth for non-OIDC apps (ADR-0014); OIDC-discovers Keycloak (now live)
+                       # via the split-horizon VIP (GATEWAY_VIP 192.168.1.53) — pre-verified in-cluster.
   # ---- Later phases: enabled when their phase opens ----
   # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
   # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate