feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4

helm/openbao-ui-overlay-k8s.yaml

@@ -1,6 +1,6 @@
 # OpenBao browser UI gateway — injects the KeyCape login overlay and proxies
-# to the OpenBao service. Public ingress for bao.coulomb.social targets this
-# gateway instead of the chart-managed OpenBao ingress.
+# to the OpenBao service. The gateway is ClusterIP-only and is reached through
+# the named openbao-ui-railiance01 operator tunnel.
 #
 # ConfigMap data is applied by scripts/openbao-ui-overlay-apply.sh from
 # helm/openbao-ui-overlay/*.
@@ -87,35 +87,3 @@ spec:
       port: 8080
       targetPort: http
       protocol: TCP
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: openbao-ui-gateway
-  namespace: openbao
-  labels:
-    app.kubernetes.io/name: openbao-ui-gateway
-    app.kubernetes.io/part-of: railiance-platform
-    railiance-platform/component: secrets
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.middlewares: >-
-      openbao-openbao-rate-limit@kubernetescrd,
-      openbao-openbao-hsts@kubernetescrd
-spec:
-  ingressClassName: traefik
-  tls:
-    - secretName: bao-tls
-      hosts:
-        - bao.coulomb.social
-  rules:
-    - host: bao.coulomb.social
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: openbao-ui-gateway
-                port:
-                  number: 8080