Deploy approval service and verify native persistence and audit

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

deploy/keycape-ingress.yaml

@@ -0,0 +1,21 @@
+# APPROVAL-WP-0002-T03 / SECRETS-WP-0010-T03: exact verifier JWKS peer.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-approval-engine-to-keycape
+  namespace: sso
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: keycape
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: approval-engine
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: approval-engine
+      ports:
+        - {protocol: TCP, port: 8080}