fix(netpol): allow Traefik→ACME solver pods; mark T02–T07 done on RAILIANCE01

Added allow-traefik-to-acme-solver NetworkPolicy to sso and mfa namespaces.
The default-deny-all policy was blocking HTTP-01 challenge traffic from Traefik
to the cert-manager solver pods, causing all TLS certs to stay pending (502).

Workplan NK-WP-0003 updated: T02, T03, T04, T05, T06, T07, T08a all done on
RAILIANCE01 as of 2026-03-25. T08 (e2e auth test) is now unblocked.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/k8s/network-policies/netpol-mfa.yaml

@@ -90,6 +90,30 @@ spec:
         - port: 5432
           protocol: TCP
 ---
+# ── Traefik → ACME HTTP-01 solver pods :8089 ─────────────────────────────────
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-traefik-to-acme-solver
+  namespace: mfa
+spec:
+  podSelector:
+    matchLabels:
+      acme.cert-manager.io/http01-solver: "true"
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - port: 8089
+          protocol: TCP
+---
 # ── Allow egress DNS (all pods) ──────────────────────────────────────────────
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy

sso-mfa/k8s/network-policies/netpol-sso.yaml

@@ -244,6 +244,32 @@ spec:
         - port: 3890
           protocol: TCP
 ---
+# ── Traefik → ACME HTTP-01 solver pods :8089 ─────────────────────────────────
+# cert-manager creates temporary solver pods during TLS cert issuance.
+# default-deny-all blocks Traefik from reaching them; this policy allows it.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-traefik-to-acme-solver
+  namespace: sso
+spec:
+  podSelector:
+    matchLabels:
+      acme.cert-manager.io/http01-solver: "true"
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - port: 8089
+          protocol: TCP
+---
 # ── Allow egress DNS (all pods) ──────────────────────────────────────────────
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy