fix: gateway authentik port 80→9000 + encrypt internal infrastructure URLs
Security improvements:
- Fix NetworkPolicy port: gateway→authentik 80→9000
- Encrypt internal cluster DNS names (.svc.cluster.local)
- SOPS encryption preserves Kubernetes structure (apiVersion, kind, metadata)
- Only sensitive URLs are encrypted, not the config structure
What's encrypted:
✓ jwksUrl, tokenUrl (authentik endpoints)
✓ All upstream service URLs (.svc.cluster.local)
✓ Internal infrastructure topology
What stays readable:
✓ apiVersion, kind (Kubernetes needs these)
✓ metadata.name, namespace (pod identification)
✓ Configuration structure
Fixes JWT validation failures and 401 errors on LLM requests.
Admin Bot
04619a269f