Build Authentik forward-auth primitive; gate Prometheus and Alertmanager (#137)

[nickvigilante]

Builds a reusable domain-level Authentik forward-auth primitive and uses it to expose the Prometheus and Alertmanager admin UIs behind SSO, fixing their dead externalUrl links.

Refs #137, #117. Spec + plan in docs/superpowers/.

What's here

The primitive (defined once):

• k8s/authentik/blueprints/applications/forward-auth.yaml — a proxy provider in forward_domain mode (cookie scoped to vigihome.net), assigned to the embedded outpost, gated on homelab-users.
• k8s/authentik/ingress-forward-auth-outpost.yaml — the un-gated /outpost.goauthentik.io handshake route, co-located in the auth namespace so cross-namespace middleware trust is never needed.
• k8s/kube-prometheus-stack/middleware-forward-auth.yaml — the monitoring-namespace forwardAuth middleware copy.

First consumers (k8s/kube-prometheus-stack/values.yaml):

• Prometheus and Alertmanager Ingresses at prometheus.vigihome.net / alertmanager.vigihome.net, gated by the middleware.
• Real externalUrls on both, replacing the http://localhost:9093 placeholder so alert-notification email links resolve.

Key decisions

• Domain-level, embedded outpost, gated on homelab-users — gating a future no-auth service becomes one Ingress annotation.
• allowCrossNamespace stays OFF — the outpost route lives in auth, the middleware is copied per-namespace; no change to the Ansible-owned Traefik chart.
• The existing websecure-default strip-auth-headers middleware complements forward-auth (runs first → blanks client-spoofed X-authentik-*; forwardAuth re-injects authoritatively after).
• Field names, the forward_domain mode, flow slugs, and the authentik-server Service port 80 (not 9000) were all pinned against the live Authentik 2026.2.2.

⚠️ Not yet applied — post-merge cutover (in order)

Flux tracks main, so nothing is live until merge. After squash-merge, on the laptop:

1. Blueprint: render the authentik-blueprints ConfigMap (kubectl create configmap … --from-file=… | apply), rollout restart deploy/authentik-worker, trigger discovery. Verify the embedded outpost shows the provider.
2. Middleware + outpost route: flux reconcile kustomization auth and … kps (or wait for the interval). Verify curl https://prometheus.vigihome.net/outpost.goauthentik.io/ping → 204.
3. Gate: helm upgrade kps prometheus-community/kube-prometheus-stack --version 85.3.3 -n monitoring -f k8s/kube-prometheus-stack/values.yaml.

Full steps in docs/superpowers/plans/2026-06-26-forward-auth.md (Tasks 1–4 apply sections + Task 5).

Acceptance matrix (run during cutover)

• Unauthenticated https://prometheus.vigihome.net → 302 to Authentik; same for Alertmanager.
• homelab-users member → UI loads; non-member → 403.
• Forged X-authentik-username header → still 302 (no spoof bypass).
• Break-glass: kubectl -n monitoring port-forward svc/kps-kube-prometheus-stack-prometheus 9090:9090 reaches the UI with Authentik out of the path.
• An alert email's link now points at https://alertmanager.vigihome.net and resolves.

Checklist

• Secrets: none added. The blueprint uses !Find/!KeyOf only; no credentials in the repo.
• Backup wiring: n/a — no new persistent dirs.
• SPOF impact: forward-auth makes Authentik a hard dependency for these two UIs. They have no native login, so the documented break-glass is kubectl port-forward (bypasses Traefik/Authentik); no Bitwarden fallback credential applies. Documented in k8s/kube-prometheus-stack/README.md.