Security improvements: - Fix gateway→authentik port from 80 to 9000 (matches NetworkPolicy) - Encrypt gateway ConfigMap (contains internal cluster DNS names) - Encrypt gateway-config-secret with SOPS using AGE encryption - Add .sops.yaml configuration for future secret management Files encrypted with AGE key: - k8s/configmap.yaml (ConfigMap → encrypted) - k8s/gateway-config-secret.enc.yaml (Secret → encrypted) Internal infrastructure details now protected: ✓ Service DNS names (.svc.cluster.local) ✓ Upstream URLs ✓ Auth endpoints ✓ Port configurations Fixes JWT validation failures and 401 errors on LLM requests. Reduces attack surface by protecting infrastructure topology.
