Activate ACTIVITY-WP-0025: Authelia SSO ingress for ops and Temporal UI

Mark workplan active. Add Traefik ForwardAuth middleware and Ingress
manifests for activity.coulomb.social and activity-temporal.coulomb.social.
Prefer Authelia SSO identity for ops mutations; document DNS gate and
fleet pattern (docs/ops-sso-access.md).

k8s/railiance/30-authelia-middleware.yaml

@@ -0,0 +1,22 @@
+# Traefik ForwardAuth → Authelia (fleet SSO).
+# Pattern: net-kingdom sso-mfa Authelia at auth.coulomb.social
+# ACTIVITY-WP-0025
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authelia-forwardauth
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: activity-core
+    app.kubernetes.io/part-of: activity-core
+    app.kubernetes.io/component: sso
+spec:
+  forwardAuth:
+    # rd= sends the browser to the Authelia login portal when unauthenticated.
+    address: http://authelia.sso.svc.cluster.local:9091/api/verify?rd=https://auth.coulomb.social/
+    trustForwardHeader: true
+    authResponseHeaders:
+      - Remote-User
+      - Remote-Groups
+      - Remote-Name
+      - Remote-Email