Add KeyCape login overlay gateway for OpenBao browser UI

Streamline bao.coulomb.social login as "Sign in with KeyCape" via a versioned
nginx gateway that injects overlay assets and proxies to OpenBao. Disable chart
ingress in favor of the overlay ingress, wire make openbao-deploy, and add
openbao-verify-login-overlay with upstream drift detection.

Makefile

@@ -14,9 +14,14 @@ OPENBAO_NAMESPACE ?= openbao
 OPENBAO_RELEASE ?= openbao
 OPENBAO_VALUES ?= helm/openbao-values.yaml
 OPENBAO_MIDDLEWARE ?= helm/openbao-middleware.yaml
+OPENBAO_UI_OVERLAY_DIR ?= helm/openbao-ui-overlay
+OPENBAO_UI_OVERLAY_K8S ?= helm/openbao-ui-overlay-k8s.yaml
 OPENBAO_VERIFY_AUTH_ARGS ?=
 OPENBAO_RESTORE_EVIDENCE ?= /tmp/netkingdom-openbao-restore-drill/evidence.json
 OPENBAO_EMERGENCY_EVIDENCE ?= /tmp/netkingdom-openbao-emergency-drill/evidence.json
+ARGOCD_NAMESPACE ?= argocd
+ARGOCD_BOOTSTRAP_DIR ?= argocd/bootstrap
+ARGOCD_REPOSITORY_SECRET ?=
 
 ##@ CloudNative PG (cnpg) — primary database operator
 
@@ -103,6 +108,16 @@ openbao-dry-run: openbao-repo ## Render the OpenBao Helm release without applyin
 		-f $(OPENBAO_VALUES) \
 		--dry-run
 
+openbao-overlay-apply: ## Apply KeyCape login overlay gateway and assets
+	OPENBAO_UI_OVERLAY_DIR=$(OPENBAO_UI_OVERLAY_DIR) \
+	  OPENBAO_UI_OVERLAY_K8S=$(OPENBAO_UI_OVERLAY_K8S) \
+	  KUBECTL='$(KUBECTL)' OPENBAO_NAMESPACE=$(OPENBAO_NAMESPACE) \
+	  scripts/openbao-ui-overlay-apply.sh
+
+openbao-verify-login-overlay: ## Verify public KeyCape login overlay is active
+	OPENBAO_UI_OVERLAY_DIR=$(OPENBAO_UI_OVERLAY_DIR) \
+	  scripts/openbao-verify-login-overlay.sh $(OPENBAO_VERIFY_LOGIN_OVERLAY_ARGS)
+
 openbao-deploy: openbao-repo ## Deploy / upgrade OpenBao to the openbao namespace
 	$(KUBECTL) create namespace $(OPENBAO_NAMESPACE) --dry-run=client -o yaml | $(KUBECTL) apply -f -
 	$(KUBECTL) apply -f $(OPENBAO_MIDDLEWARE)
@@ -111,6 +126,7 @@ openbao-deploy: openbao-repo ## Deploy / upgrade OpenBao to the openbao namespac
 		--namespace $(OPENBAO_NAMESPACE) \
 		-f $(OPENBAO_VALUES) \
 		--wait --timeout 5m
+	$(MAKE) openbao-overlay-apply
 
 openbao-status: ## Show OpenBao pods, services, PVCs, and seal/init status
 	$(KUBECTL) get pods,svc,pvc -n $(OPENBAO_NAMESPACE) \
@@ -149,6 +165,27 @@ openbao-validate-emergency-evidence: ## Validate non-secret OpenBao emergency se
 	OPENBAO_EMERGENCY_EVIDENCE='$(OPENBAO_EMERGENCY_EVIDENCE)' \
 	  scripts/openbao-validate-emergency-drill-evidence.sh
 
+##@ ArgoCD GitOps bootstrap
+
+argocd-bootstrap-dry-run: ## Server-side dry-run ArgoCD AppProjects and root Application
+	$(KUBECTL) apply --dry-run=server -k $(ARGOCD_BOOTSTRAP_DIR)
+
+argocd-bootstrap-deploy: ## Apply ArgoCD AppProjects and root Application
+	$(KUBECTL) apply -k $(ARGOCD_BOOTSTRAP_DIR)
+
+argocd-repo-apply: ## Apply a SOPS-encrypted ArgoCD repository Secret (set ARGOCD_REPOSITORY_SECRET)
+	@test -n "$(ARGOCD_REPOSITORY_SECRET)" || \
+	  (echo "ERROR: set ARGOCD_REPOSITORY_SECRET=argocd/repositories/<repo>.repository.sops.yaml"; exit 1)
+	sops -d $(ARGOCD_REPOSITORY_SECRET) | $(KUBECTL) apply -f -
+
+argocd-status: ## Show Railiance ArgoCD projects, root app, and registered repos
+	$(KUBECTL) get appprojects.argoproj.io -n $(ARGOCD_NAMESPACE) \
+	  railiance-bootstrap railiance-tenants
+	$(KUBECTL) get applications.argoproj.io -n $(ARGOCD_NAMESPACE) \
+	  railiance-apps-root
+	$(KUBECTL) get secrets -n $(ARGOCD_NAMESPACE) \
+	  -l argocd.argoproj.io/secret-type=repository
+
 ##@ Backup
 
 backup: ## Backup platform services (PostgreSQL logical dump) — age-encrypted to Nextcloud
@@ -161,4 +198,4 @@ help: ## Show this help
 	  /^[a-zA-Z_-]+:.*?##/ { printf "  \033[36m%-22s\033[0m %s\n", $$1, $$2 } \
 	  /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST)
 
-.PHONY: db-deploy db-status db-shell db-logs apps-pg-deploy apps-pg-status apps-pg-shell apps-pg-logs net-kingdom-pg-inter-hub-networkpolicy-deploy pg-deploy pg-status pg-pgpool-check valkey-deploy valkey-status openbao-repo openbao-dry-run openbao-deploy openbao-status openbao-verify openbao-verify-post-unseal openbao-configure-initial openbao-configure-ssh openbao-verify-ssh openbao-verify-authenticated openbao-validate-restore-evidence openbao-validate-emergency-evidence backup help
+.PHONY: db-deploy db-status db-shell db-logs apps-pg-deploy apps-pg-status apps-pg-shell apps-pg-logs net-kingdom-pg-inter-hub-networkpolicy-deploy pg-deploy pg-status pg-pgpool-check valkey-deploy valkey-status openbao-repo openbao-dry-run openbao-overlay-apply openbao-verify-login-overlay openbao-deploy openbao-status openbao-verify openbao-verify-post-unseal openbao-configure-initial openbao-configure-ssh openbao-verify-ssh openbao-verify-authenticated openbao-validate-restore-evidence openbao-validate-emergency-evidence argocd-bootstrap-dry-run argocd-bootstrap-deploy argocd-repo-apply argocd-status backup help