fix(ingress): restore the authentik.riotpiao.com route

Commit a02bee5 had both the Ingress rule and the cloudflared tunnel
hostname for authentik.riotpiao.com. Both were lost, so the tunnel
answered 404 for the hostname and the ingress had no matching rule.

The CoreDNS rewrite and the authentik-server Service were still intact;
only the two routing entries were missing. Re-add the Ingress (namespace
iam, service authentik-server port 80, TLS terminated by the wildcard
default-ssl-certificate) and the tunnel hostname.

k8s/apps/cloudflared/configmap.yaml

@@ -53,4 +53,8 @@ data:
       # even though the DNS CNAME points at the tunnel.
       - hostname: zitadel.riotpiao.com
         service: https://zitadel.riotpiao.com
+      # AUTHENTIK. Same reasoning as ZITADEL: a hostname absent from this table
+      # gets 404 from the connector. CoreDNS rewrites the name to ingress-nginx.
+      - hostname: authentik.riotpiao.com
+        service: https://authentik.riotpiao.com
       - service: http_status:404

k8s/bootstrap/ingress/ingress.yaml

@@ -275,3 +275,31 @@ spec:
                 name: temporal-web
                 port:
                   number: 8080
+
+---
+# ── Authentik (identity provider) ─────────────────────────────────────────────
+# The chart's ingress is disabled in k8s/infra/iam/authentik-values.yaml; the
+# rule lives here so ingress-config owns every hostname. TLS terminates at
+# nginx via the wildcard default-ssl-certificate, so the backend stays HTTP.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: authentik
+  namespace: iam
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "16m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: authentik.riotpiao.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: authentik-server
+                port:
+                  number: 80