Activate ACTIVITY-WP-0025: Authelia SSO ingress for ops and Temporal UI

Mark workplan active. Add Traefik ForwardAuth middleware and Ingress
manifests for activity.coulomb.social and activity-temporal.coulomb.social.
Prefer Authelia SSO identity for ops mutations; document DNS gate and
fleet pattern (docs/ops-sso-access.md).

docs/ops-sso-access.md

@@ -0,0 +1,94 @@
+# Ops console + Temporal UI — SSO access design (ACTIVITY-WP-0025)
+
+## Audience
+
+Founders / platform operators who already have Authelia accounts under
+`coulomb.social` SSO (LLDAP → Authelia → KeyCape MFA path).
+
+## Hostnames (locked)
+
+| Host | Backend | Purpose |
+| --- | --- | --- |
+| `activity.coulomb.social` | `actcore-api:8010` | Ops console `/ops/ui`, JSON `/ops/*`, existing API |
+| `activity-temporal.coulomb.social` | `actcore-temporal-ui:8080` | Temporal Web UI |
+
+Both resolve to the railiance01 Traefik LB (`92.205.62.239`) once DNS A records
+exist (same pattern as `forgejo.coulomb.social`).
+
+## Auth edge (fleet pattern)
+
+| Component | Location |
+| --- | --- |
+| Ingress controller | Traefik (`ingressClassName: traefik`) |
+| TLS | cert-manager `ClusterIssuer/letsencrypt-prod` |
+| Login portal | Authelia `https://auth.coulomb.social` |
+| IAM / MFA | KeyCape `https://kc.coulomb.social` (post-password) |
+| Forward auth | Traefik Middleware `forwardAuth` → Authelia `/api/verify` |
+
+**Not** oauth2-proxy — the live railiance01 stack already runs Authelia in
+namespace `sso`. Reuse it.
+
+### Middleware
+
+`Middleware/authelia-forwardauth` in `activity-core` calls:
+
+```text
+http://authelia.sso.svc.cluster.local:9091/api/verify?rd=https://auth.coulomb.social/
+```
+
+Response headers trusted into the app:
+
+- `Remote-User`
+- `Remote-Groups`
+- `Remote-Name`
+- `Remote-Email`
+
+### Access control policy
+
+Authelia global `default_policy: one_factor` currently applies. MVP accepts any
+authenticated Authelia user. Follow-up (T06): LLDAP group
+`activity-core-operators` + Authelia domain rules (net-kingdom config change).
+
+## Mutation identity
+
+Priority for ops mutations (`POST /ops/...`):
+
+1. SSO principal from Authelia headers (preferred)
+2. Shared `ACTIVITY_CORE_OPERATOR_TOKEN` (break-glass)
+3. Else 401/403 fail-closed
+
+## DNS (operator)
+
+Create A records (or CNAME to the forgejo host pattern):
+
+```text
+activity.coulomb.social           A  92.205.62.239
+activity-temporal.coulomb.social  A  92.205.62.239
+```
+
+Until DNS exists, cert-manager Certificate will stay Pending and HTTPS will not
+serve. Manifests can still be applied.
+
+## Break-glass
+
+Port-forward remains documented in `docs/runbook.md` if Ingress/SSO is down.
+
+## Manifests
+
+- `k8s/railiance/30-authelia-middleware.yaml`
+- `k8s/railiance/31-ingress-ops-sso.yaml`
+- `k8s/railiance/32-ingress-temporal-sso.yaml`
+
+Apply after DNS:
+
+```bash
+export KUBECONFIG=~/.kube/config-hosteurope
+kubectl apply -f k8s/railiance/30-authelia-middleware.yaml
+kubectl apply -f k8s/railiance/31-ingress-ops-sso.yaml
+kubectl apply -f k8s/railiance/32-ingress-temporal-sso.yaml
+# set public Temporal URL on API after cert Ready:
+kubectl -n activity-core set env deploy/actcore-api \
+  ACTIVITY_CORE_TEMPORAL_UI_URL=https://activity-temporal.coulomb.social
+kubectl -n activity-core set env deploy/actcore-temporal-ui \
+  TEMPORAL_CORS_ORIGINS=https://activity-temporal.coulomb.social
+```

docs/runbook.md

@@ -105,31 +105,39 @@ the UI** — change definition files and sync.
 
 ### Production access (railiance01)
 
-API remains **ClusterIP** (no public Ingress in WP-0024; SSO planned in
-ACTIVITY-WP-0025). Use the **hosteurope / railiance01** kubeconfig, not a local
-empty cluster.
+**Primary (SSO — ACTIVITY-WP-0025):** after DNS A records exist:
+
+| UI | URL |
+| --- | --- |
+| Ops console | https://activity.coulomb.social/ops/ui |
+| Temporal Web UI | https://activity-temporal.coulomb.social |
+
+Login via Authelia (`auth.coulomb.social`). Design: `docs/ops-sso-access.md`.
+Mutations accept SSO identity headers; shared token is break-glass only.
+
+**DNS (required for TLS):**
+
+```text
+activity.coulomb.social           A  92.205.62.239
+activity-temporal.coulomb.social  A  92.205.62.239
+```
+
+**Break-glass port-forward** (hosteurope kubeconfig):
 
 ```bash
 export KUBECONFIG=~/.kube/config-hosteurope
-
-# Ops console (activity-core API)
 kubectl -n activity-core port-forward svc/actcore-api 8010:8010
-# Browser: http://127.0.0.1:8010/ops/ui
-
-# Temporal Web UI (second terminal — linked from ops nav as "Temporal UI")
 kubectl -n activity-core port-forward svc/actcore-temporal-ui 8080:8080
-# Browser: http://127.0.0.1:8080
+# http://127.0.0.1:8010/ops/ui  and  http://127.0.0.1:8080
 ```
 
-Override the Temporal link target if needed:
+Env overrides:
 
 ```bash
-# on actcore-api
-ACTIVITY_CORE_TEMPORAL_UI_URL=http://127.0.0.1:8080
+ACTIVITY_CORE_TEMPORAL_UI_URL=https://activity-temporal.coulomb.social
+ACTIVITY_CORE_OPERATOR_TOKEN=…   # break-glass; in actcore-runtime-secret
 ```
 
-Ensure `ACTIVITY_CORE_OPERATOR_TOKEN` is set on actcore-api (runtime secret key).
-
 Bootstrap token (operator workstation; never commit the value):
 
 ```bash