ignis: add basic auth via envoy SecurityPolicy

Ignis has no built-in auth; required now that ignis.fireflylab.cc
is a public hostname. Plain k8s Secret (no Vault yet) holding an
htpasswd hash, enforced at gateway via SecurityPolicy.

apps/ignis/chart/templates/basic-auth.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.auth.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-basic-auth
+type: Opaque
+stringData:
+  .htpasswd: {{ .Values.auth.htpasswd | quote }}
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: {{ .Release.Name }}-basic-auth
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: {{ .Release.Name }}
+  basicAuth:
+    users:
+      name: {{ .Release.Name }}-basic-auth
+{{- end }}

apps/ignis/chart/templates/httproute.yaml

@@ -3,8 +3,9 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: {{ .Release.Name }}
-  # No built-in auth in Ignis itself — LAN-only exposure, same tradeoff
-  # already accepted for Vault in cluster-platform.
+  # Ignis has no built-in auth — basic-auth enforced at the gateway via
+  # SecurityPolicy (see basic-auth.yaml), required since one hostname is
+  # public-facing (ignis.fireflylab.cc).
 spec:
   parentRefs:
     - name: envoy-gateway