refactor(poimen): move frontend k8s manifests to poimen-frontend repo

- Remove Deployment/Service/NetworkPolicy from homelab (wrong place)
- Add k8s/apps/poimen-frontend/ with ingress only (edge concern, same as api-gw)
- Update 70-poimen.yaml: source 4 → poimen-frontend.git k8s/
                          source 5 → homelab k8s/apps/poimen-frontend/ (ingress)

k8s/apps/poimen-frontend/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# Edge Ingress for poimen.riotpiao.com.
+# Same pattern as k8s/apps/api/ (api-gw ingress).
+# App manifests (Deployment, Service, NetworkPolicy) live in
+# riotpiao-poimen/poimen-frontend.git k8s/ — each repo owns its own k8s.
+resources:
+  - ingress.yaml

k8s/apps/poimen/frontend-deployment.yaml

@@ -1,108 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: poimen-frontend
-  namespace: poimen
-  labels:
-    app: poimen-frontend
-    app.kubernetes.io/name: poimen-frontend
-    app.kubernetes.io/component: frontend
-    app.kubernetes.io/part-of: poimen
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-    reloader.stakater.com/auto: "true"
-spec:
-  replicas: 2
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: poimen-frontend
-  template:
-    metadata:
-      labels:
-        app: poimen-frontend
-        app.kubernetes.io/name: poimen-frontend
-        # Admitted by llm-serving-default-deny NetworkPolicy (port 8080).
-        # Required for server-side LLM calls through api-gw.
-        llm-client: "true"
-    spec:
-      imagePullSecrets:
-        - name: forgejo-registry
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1001
-        fsGroup: 1001
-      containers:
-        - name: frontend
-          image: forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend:latest
-          imagePullPolicy: Always
-          ports:
-            - name: http
-              containerPort: 3000
-              protocol: TCP
-          env:
-            # In-cluster api-gw (server-side only — never exposed to browser)
-            - name: LLM_API_URL
-              value: "http://api-gateway.api.svc.cluster.local:8080"
-            # Memory service (co-located in poimen namespace)
-            - name: POIMEN_MEMORY_URL
-              valueFrom:
-                configMapKeyRef:
-                  name: poimen-config
-                  key: POIMEN_MEMORY_URL
-            # OIDC — uses same client as existing poimen services
-            # Use in-cluster Authentik (port 80 → pod 9000) to avoid Cloudflare hairpin.
-            # External URL in poimen-secrets is for out-of-cluster clients only.
-            - name: LLM_OIDC_TOKEN_URL
-              value: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
-            - name: LLM_OIDC_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: poimen-secrets
-                  key: LLM_OIDC_CLIENT_ID
-            - name: LLM_OIDC_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: poimen-secrets
-                  key: LLM_OIDC_CLIENT_SECRET
-            - name: LLM_OIDC_SCOPE
-              valueFrom:
-                secretKeyRef:
-                  name: poimen-secrets
-                  key: LLM_OIDC_SCOPE
-            # Gotify (server-side notifications + HITL messages)
-            - name: GOTIFY_URL
-              value: "http://gotify.notifications.svc.cluster.local"
-            - name: GOTIFY_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: poimen-secrets
-                  key: GOTIFY_TOKEN
-            # Public env — embedded in browser bundle at build time
-            - name: NEXT_PUBLIC_API_URL
-              value: "https://api.riotpiao.com"
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: 1000m
-              memory: 512Mi
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            failureThreshold: 3
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            failureThreshold: 3

k8s/apps/poimen/frontend-networkpolicy.yaml

@@ -1,78 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: poimen-frontend-egress
-  namespace: poimen
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  podSelector:
-    matchLabels:
-      app: poimen-frontend
-  policyTypes:
-    - Ingress
-    - Egress
-
-  ingress:
-    # Allow from ingress-nginx controller → frontend on port 3000
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: ingress-nginx
-      ports:
-        - protocol: TCP
-          port: 3000
-
-  egress:
-    # DNS — required for all in-cluster service resolution
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-      ports:
-        - protocol: UDP
-          port: 53
-        - protocol: TCP
-          port: 53
-
-    # api-gw (api namespace) — all server-side LLM + workflow + memory calls
-    # api-gw NetworkPolicy already allows ingress from poimen namespace.
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: api
-      ports:
-        - protocol: TCP
-          port: 8080
-
-    # Memory service (co-located in poimen namespace) — GraphQL session queries
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: poimen
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: poimen-memory
-      ports:
-        - protocol: TCP
-          port: 8080
-
-    # Gotify (notifications namespace) — /api/notify/messages server-side poll
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: notifications
-      ports:
-        - protocol: TCP
-          port: 80
-
-    # Authentik (iam namespace) — OIDC token fetch + JWKS verification
-    - to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: iam
-      ports:
-        - protocol: TCP
-          port: 9000
-        - protocol: TCP
-          port: 9443

k8s/apps/poimen/frontend-service.yaml

@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: poimen-frontend
-  namespace: poimen
-  labels:
-    app: poimen-frontend
-    app.kubernetes.io/name: poimen-frontend
-spec:
-  type: ClusterIP
-  selector:
-    app: poimen-frontend
-  ports:
-    - name: http
-      port: 3000
-      targetPort: http
-      protocol: TCP

k8s/apps/poimen/kustomization.yaml

@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-# Poimen frontend — Deployment, Service, Ingress for poimen.riotpiao.com.
-# Part of the `poimen` ArgoCD Application (multi-source, source 4).
-# All resources deploy into namespace `poimen` (same as workers and memory).
-# api-gw NetworkPolicy already allows ingress from namespace poimen.
-# Memory service is co-located — no additional NetworkPolicy needed.
-resources:
-  - frontend-deployment.yaml
-  - frontend-service.yaml
-  - frontend-ingress.yaml
-  - frontend-networkpolicy.yaml

k8s/argocd/apps/70-poimen.yaml

@@ -61,12 +61,17 @@ spec:
       targetRevision: main
       path: k8s/infra/poimen
 
-    # 4. Frontend — poimen.riotpiao.com (Deployment, Service, Ingress)
+    # 4. Frontend app manifests — Deployment, Service, NetworkPolicy.
-    #    Manifests live in homelab so all infra is in one place (Q4: C).
+    #    Each repo owns its own k8s/ (same pattern as homelab-frontend for api-gw).
-    #    Image tag managed by Image Updater above.
+    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend.git
+      targetRevision: main
+      path: k8s
+
+    # 5. Frontend ingress — poimen.riotpiao.com edge route.
+    #    Lives in homelab (same pattern as k8s/apps/api/ for api-gw).
     - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
       targetRevision: main
-      path: k8s/apps/poimen
+      path: k8s/apps/poimen-frontend
 
   destination:
     server: https://kubernetes.default.svc