Finish WP-0025 SSO cutover except group allowlist residual.

Mark T03–T05 and T07–T08 done after live Authelia/TLS verification,
prefer SSO principal in ops UI copy and audits, and document break-glass
port-forward. Leave T06 waiting on net-kingdom LLDAP/Authelia group rules.

k8s/railiance/README.md

@@ -1,9 +1,9 @@
 # Railiance01 Kubernetes Deployment
 
 This bundle establishes activity-core as an internal production service on the
-railiance01 K3s cluster. It keeps the unauthenticated API as a ClusterIP service;
-publish it through an authenticated ingress only after choosing the final host
-name and access policy.
+railiance01 K3s cluster. Services remain ClusterIP; browser access to the ops
+console and Temporal UI is via Traefik + Authelia SSO Ingress
+(`activity.coulomb.social`, `temporal.coulomb.social` — ACTIVITY-WP-0025).
 
 ## Layout
 
@@ -113,23 +113,26 @@ kubectl -n activity-core get svc
 
 ## Operator automation console (ACTIVITY-WP-0024 / 0025)
 
-### SSO (primary, after DNS)
+### SSO (primary — live)
+
+Manifests `30-`–`32-*.yaml` are applied; TLS certs Ready; Authelia ForwardAuth
+redirects unauthenticated browsers to `auth.coulomb.social`.
 
 ```bash
-# DNS A records → 92.205.62.239 (once):
-#   activity.coulomb.social
-#   temporal.coulomb.social
-
+# Re-apply if needed:
 kubectl apply -f k8s/railiance/30-authelia-middleware.yaml
 kubectl apply -f k8s/railiance/31-ingress-ops-sso.yaml
 kubectl apply -f k8s/railiance/32-ingress-temporal-sso.yaml
 kubectl -n activity-core set env deploy/actcore-api \
   ACTIVITY_CORE_TEMPORAL_UI_URL=https://temporal.coulomb.social
+kubectl -n activity-core set env deploy/actcore-temporal-ui \
+  TEMPORAL_CORS_ORIGINS=https://temporal.coulomb.social,http://localhost:8080,http://127.0.0.1:8080
 ```
 
 - Ops: https://activity.coulomb.social/ops/ui (Authelia SSO)
 - Temporal: https://temporal.coulomb.social
 - Design: `docs/ops-sso-access.md`
+- Follow-up: LLDAP group `activity-core-operators` + Authelia domain rules (T06)
 
 ### Break-glass port-forward