WP-0014: Helm adopt and deploy Core Hub on CoulombCore; backup auth tooling

Adopt live Core Hub resources, align prod ConfigMap naming, default production
image registry to gitea, and install Helm release core-hub rev 1 (smoke passed).
Add apps-pg-backup and check-backup-lane-auth targets; document OIDC login
requirement now that OpenBao is unsealed.

tools/core-hub-helm-adopt.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Adopt live Core Hub manifests into Helm release ownership (WP-0014-T02).
+set -euo pipefail
+
+namespace="${CORE_HUB_NAMESPACE:-core-hub}"
+release="${CORE_HUB_RELEASE:-core-hub}"
+
+resources=(
+  "deployment/core-hub-api"
+  "service/core-hub-api"
+  "configmap/core-hub-prod-runtime"
+  "ingress/core-hub"
+)
+
+echo "Adopting Core Hub resources into Helm release ${release}/${namespace}"
+for resource in "${resources[@]}"; do
+  echo "  ${resource}"
+  kubectl annotate -n "$namespace" "$resource" \
+    meta.helm.sh/release-name="$release" \
+    meta.helm.sh/release-namespace="$namespace" \
+    --overwrite
+  kubectl label -n "$namespace" "$resource" \
+    app.kubernetes.io/managed-by=Helm \
+    --overwrite
+done
+
+echo "ok: adoption metadata applied — run core-hub-server-dry-run next"