platform: move Headlamp out of the gating platform tier + fix -session-ttl crashloop

Headlamp's HelmRelease sat in the wait:true `platform` Flux tier. Its pod
crashlooped (`flag provided but not defined: -session-ttl` — chart 0.40.1
renders a container arg the appVersion v0.40.1 backend lacks; upstream
kubernetes-sigs/headlamp#4883), and because it gated `platform`, the whole
chain stalled: platform Ready=Unknown -> platform-config, oauth2-proxy,
apps-wave-0/1/2 and apps-vms all Ready=False "dependency not ready".

Part A (unblock + durable lesson): a leaf UI must never gate the chain. Move
all Headlamp resources into a new non-gating Flux Kustomization
clusters/base/headlamp.yaml (dependsOn platform-config, wait:false, SOPS
decryption patched per-env in clusters/dev) — mirroring oauth2-proxy exactly.
The new Kustomization owns the whole platform/headlamp component; its HTTPRoute
moves from platform-config into platform/headlamp/kustomization.yaml. Removed
headlamp from platform/kustomization.yaml and its httproute from
platform-config/kustomization.yaml. Now a crashlooping Headlamp can never stall
platform/platform-config/apps.

Part B (make it start): pin the chart to 0.41.0 (`>=0.41.0 <0.42.0`). The
backend added `f.Int("session-ttl", …)` in v0.41.0 and chart 0.41.0 pins that
same image (appVersion == chart version), so chart+image realign; every arg the
chart renders for our values is supported. OIDC config + per-user RBAC
(clusterRoleBinding.create:false) unchanged.

Gate: `make -C ci gate` PASS.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kustomization.yaml

@@ -34,9 +34,11 @@ resources:
   #      (clusters/base/oauth2-proxy.yaml, dependsOn platform-config). See DECISIONS-LOG.
   - cnpg               # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
   - keycloak           # Keycloak Operator (quay.io images) + SOPS admin credential
-  - headlamp           # Kubernetes dashboard — Keycloak native-OIDC login + PER-USER RBAC (ADR-0014).
-                       # HelmRelease + SOPS OIDC credential + default-deny/Cilium policies; its
-                       # HTTPRoute is a Gateway API CR in platform-config (dependsOn platform).
+  #      headlamp (Kubernetes dashboard) is DELIBERATELY NOT here: a leaf UI whose HelmRelease can
+  #      crashloop (upstream headlamp-0.40.1 `-session-ttl` chart/image desync, issue #4883) must not
+  #      sit in this wait:true tier, where its unhealth stalled platform-config + oauth2-proxy + every
+  #      apps wave/vm on "dependency not ready". It now reconciles in its own post-platform Flux
+  #      Kustomization (clusters/base/headlamp.yaml, dependsOn platform-config). See DECISIONS-LOG.
   # ---- Later phases: enabled when their phase opens ----
   # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
   # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate