Activate ACTIVITY-WP-0025: Authelia SSO ingress for ops and Temporal UI

Mark workplan active. Add Traefik ForwardAuth middleware and Ingress
manifests for activity.coulomb.social and activity-temporal.coulomb.social.
Prefer Authelia SSO identity for ops mutations; document DNS gate and
fleet pattern (docs/ops-sso-access.md).

k8s/railiance/31-ingress-ops-sso.yaml

@@ -0,0 +1,34 @@
+# HTTPS SSO front door for activity-core ops console + API.
+# Requires DNS: activity.coulomb.social A → 92.205.62.239
+# ACTIVITY-WP-0025
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: actcore-ops
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: actcore-api
+    app.kubernetes.io/part-of: activity-core
+    app.kubernetes.io/component: sso-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: activity-core-authelia-forwardauth@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - activity.coulomb.social
+      secretName: actcore-ops-tls
+  rules:
+    - host: activity.coulomb.social
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: actcore-api
+                port:
+                  number: 8010