feat(informed-decision): claim decisions.coulomb.social as the approver origin

INFD-WP-0001-T07 has been blocked since 2026-09-08 on an OIDC redirect URI it
cannot publish without a real deployed origin, which in turn blocks key-cape's
KEY-WP-0013-T02. The operator assigned decisions.coulomb.social; DNS already
resolves to the cluster address.

Adds the Ingress + letsencrypt-prod certificate for the host and a placeholder
nginx backend, so the origin answers before the approver UI itself exists
(INFD-WP-0001-T08 is still gated on approval-engine and on intake INFD-IN-0003).
A redirect URI matches byte-exactly at /authorize, so a host that resolves but
does not complete a TLS handshake fails closed at first login and presents as a
rejected approval rather than a registration defect.

The Ingress carries one path rule on purpose: reuse-surface reported on
2026-07-07 that an Exact rule alongside a catch-all Prefix rule on the same host
was swallowed by the catch-all. That trap is worth avoiding on a host whose
entire purpose is exact-match redirect handling.

Dry-run clean against the live API; deliberately not applied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EJbh7o7UWF4tQ5jxygnNGu

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2072522@bnt-lap001
Assistant-Session: 46173adf-7302-4ede-99d6-963b61359928

manifests/informed-decision-ingress.yaml

@@ -0,0 +1,40 @@
+# Ingress for the informed-decision approver surface on decisions.coulomb.social.
+#
+# Requires cert-manager ClusterIssuer letsencrypt-prod and DNS
+# decisions.coulomb.social -> cluster IP (A record confirmed 2026-09-10).
+#
+# ONE path rule on purpose. reuse-surface reported (2026-07-07) that a host
+# carrying an Exact /health rule alongside a catch-all `/` Prefix rule had the
+# exact match swallowed by the catch-all, so the public health URL 404'd while
+# the pod was healthy. Splitting /auth, /api and / across backends here would
+# reproduce that. Everything on this host stays on one backend; if the surface
+# ever needs a second one, set traefik.ingress.kubernetes.io/router.priority
+# explicitly rather than relying on rule order.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: informed-decision
+  namespace: informed-decision
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    # websecure only (forgejo/coulomb-social pattern): leave HTTP free for
+    # cert-manager HTTP-01 solvers. TLS app traffic stays on 443; the ACME
+    # challenge uses the solver ingress on 80.
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts: [decisions.coulomb.social]
+      secretName: informed-decision-tls
+  rules:
+    - host: decisions.coulomb.social
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: informed-decision
+                port:
+                  number: 80