feat(auth): hub sur le domaine HTTPS — routes publiques + SSO Guacamole

(Commits restés orphelins après le squash-merge de #88, poussés trop tard.)
- IngressRoutes websecure+TLS : auth./portail.funklab.online
- Guacamole : endpoints OIDC basculés sur https://auth./portail.funklab.online
  (les ports 9080/9081 restent un chemin réseau valide)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

k8s/apps/guacamole/deployment.yaml

@@ -43,19 +43,18 @@ spec:
             - name: WEBAPP_CONTEXT
               value: "ROOT"
             # --- SSO OIDC → Authentik (app « guacamole » dans l'UI Authentik) ---
-            # Endpoints navigateur : URL publique kaya.freeboxos.fr (une seule URL
-            # canonique, LAN inclus — hairpin NAT Freebox) ; JWKS : appel
-            # serveur→serveur via le Service interne
+            # URL canonique = domaine HTTPS (auth./portail.funklab.online), LAN inclus
+            # (split-horizon dnsmasq). JWKS : appel serveur→serveur via le Service interne.
             - name: OPENID_AUTHORIZATION_ENDPOINT
-              value: "http://kaya.freeboxos.fr:9081/application/o/authorize/"
+              value: "https://auth.funklab.online/application/o/authorize/"
             - name: OPENID_JWKS_ENDPOINT
               value: "http://authentik.auth.svc.cluster.local:9000/application/o/guacamole/jwks/"
             - name: OPENID_ISSUER
-              value: "http://kaya.freeboxos.fr:9081/application/o/guacamole/"
+              value: "https://auth.funklab.online/application/o/guacamole/"
             - name: OPENID_CLIENT_ID
               value: "guacamole"
             - name: OPENID_REDIRECT_URI
-              value: "http://kaya.freeboxos.fr:9080/"
+              value: "https://portail.funklab.online/"
             - name: OPENID_USERNAME_CLAIM_TYPE
               value: "preferred_username"
             - name: OPENID_SCOPE