k8s/messaging: add kafka kmsvc and temporal workflows

- Kafka 3-broker cluster (RF=3, min-ISR=2)
- kmsvc SQS-like API on Kafka
- Redis dedup (standalone, can extend to HA)
- Temporal workflow orchestration (Cassandra backend)

k8s/sqs/kmsvc-ingress-oauth2.yaml

@@ -0,0 +1,25 @@
+# Ingress for kmsvc REST API — routes to OAuth2-Proxy
+# TLS terminated here; oauth2-proxy handles OIDC auth
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kmsvc
+  namespace: sqs
+spec:
+  ingressClassName: nginx
+  tls:
+  - secretName: kmsvc-tls
+    hosts:
+    - kmsvc.riotpiao.homelab.com
+  rules:
+  - host: kmsvc.riotpiao.homelab.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: oauth2-proxy
+            port:
+              number: 4180