remove: strip all oauth2-proxy deployments

- Delete oauth2-proxy helm releases from helmfile (temporal, kmsvc, longhorn, portainer)
- Remove oauth2-proxy manifests and ingress redirects
- Add direct ingress for kmsvc management service
- Update temporal/portainer/longhorn ingress comments to reflect direct service exposure

Services now accessible without oauth2-proxy layer.

helmfile.yaml.gotmpl

@@ -812,80 +812,6 @@ releases:
               --from-literal=client_secret="{{ env "AUTHENTIK_TEMPORAL_CLIENT_SECRET" }}" \
               --dry-run=client -o yaml | kubectl apply -f -
 
-# ── OAuth2-Proxy (Authentik OIDC protection) ──────────────────────────────────
-
-  - name: oauth2-proxy-temporal
-    namespace: temporal
-    chart: ./k8s/charts/oauth2-proxy
-    values:
-      - k8s/charts/oauth2-proxy/values-temporal.yaml
-    needs:
-      - ingress-nginx/ingress-nginx
-    hooks:
-      - events: ["presync"]
-        command: bash
-        args:
-          - -c
-          - |
-            kubectl create secret generic temporal-oidc -n temporal \
-              --from-literal=clientSecret="{{ env "AUTHENTIK_TEMPORAL_CLIENT_SECRET" }}" \
-              --from-literal=cookieSecret="$(head -c 32 /dev/urandom | base64)" \
-              --dry-run=client -o yaml | kubectl apply -f -
-
-  - name: oauth2-proxy-kmsvc
-    namespace: sqs
-    chart: ./k8s/charts/oauth2-proxy
-    values:
-      - k8s/charts/oauth2-proxy/values-kmsvc.yaml
-    needs:
-      - ingress-nginx/ingress-nginx
-    hooks:
-      - events: ["presync"]
-        command: bash
-        args:
-          - -c
-          - |
-            kubectl create secret generic kmsvc-oidc -n sqs \
-              --from-literal=clientSecret="{{ env "AUTHENTIK_KMSVC_CLIENT_SECRET" }}" \
-              --from-literal=cookieSecret="$(head -c 32 /dev/urandom | base64)" \
-              --dry-run=client -o yaml | kubectl apply -f -
-
-  - name: oauth2-proxy-longhorn
-    namespace: longhorn-system
-    chart: ./k8s/charts/oauth2-proxy
-    values:
-      - k8s/charts/oauth2-proxy/values-longhorn.yaml
-    needs:
-      - ingress-nginx/ingress-nginx
-    hooks:
-      - events: ["presync"]
-        command: bash
-        args:
-          - -c
-          - |
-            kubectl create secret generic longhorn-oidc -n longhorn-system \
-              --from-literal=clientSecret="{{ env "AUTHENTIK_LONGHORN_CLIENT_SECRET" }}" \
-              --from-literal=cookieSecret="$(head -c 32 /dev/urandom | base64)" \
-              --dry-run=client -o yaml | kubectl apply -f -
-
-  - name: oauth2-proxy-portainer
-    namespace: dashboard
-    chart: ./k8s/charts/oauth2-proxy
-    values:
-      - k8s/charts/oauth2-proxy/values-portainer.yaml
-    needs:
-      - ingress-nginx/ingress-nginx
-    hooks:
-      - events: ["presync"]
-        command: bash
-        args:
-          - -c
-          - |
-            kubectl create secret generic portainer-oidc -n dashboard \
-              --from-literal=clientSecret="{{ env "AUTHENTIK_PORTAINER_CLIENT_SECRET" }}" \
-              --from-literal=cookieSecret="$(head -c 32 /dev/urandom | base64)" \
-              --dry-run=client -o yaml | kubectl apply -f -
-
 # ── Ollama LLM Server ────────────────────────────────────────────────────────
 
   - name: ollama