fix: gateway authentik port 80→9000 + encrypt internal infrastructure URLs

Security improvements:
- Fix NetworkPolicy port: gateway→authentik 80→9000
- Encrypt internal cluster DNS names (.svc.cluster.local)
- SOPS encryption preserves Kubernetes structure (apiVersion, kind, metadata)
- Only sensitive URLs are encrypted, not the config structure

What's encrypted:
✓ jwksUrl, tokenUrl (authentik endpoints)
✓ All upstream service URLs (.svc.cluster.local)
✓ Internal infrastructure topology

What stays readable:
✓ apiVersion, kind (Kubernetes needs these)
✓ metadata.name, namespace (pod identification)
✓ Configuration structure

Fixes JWT validation failures and 401 errors on LLM requests.

.sops.yaml

@@ -0,0 +1,4 @@
+creation_rules:
+  - path_regex: k8s/configmap.yaml
+    age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    encrypted_regex: '^data'