feat(infra): Meet integration, La Suite theming, Pingora SSH + meet routes

Meet: add backend/frontend/celery deployments and services, meet-config
ConfigMap, nginx SPA config, VSO secrets (meet-db-credentials VDS,
meet-django-secret and meet-livekit VSS). Wire oidc-meet OAuth2Client.

La Suite overlay discipline: move people/docs frontend nginx ConfigMaps
and patches from overlays/local to base so both environments share them.
Remove values-ory.yaml (folded into base). Add docs-frontend nginx config
with sub_filter theming. Add local gitea mkcert CA patch.

Pingora: add [ssh] TCP passthrough block (port 22 → Gitea SSH pod) and
split meet route into frontend default + backend paths for /api/, /admin/,
/oidc/, /static/, /__. Remove now-unused values-pingora.yaml from production
overlay (host ports moved to patch-pingora-hostport.yaml).

Update both overlay kustomizations to reference all new resources and
add meet-backend/meet-frontend image entries.

overlays/local/kustomization.yaml

@@ -12,7 +12,6 @@ kind: Kustomization
 # replace DOMAIN_SUFFIX with <LIMA_IP>.sslip.io before kubectl apply.
 
 resources:
-  - people-frontend-nginx-configmap.yaml
   - ../../base/ingress
   - ../../base/ory
   - ../../base/data
@@ -23,12 +22,6 @@ resources:
   - ../../base/vso
 
 images:
-  # Pulled from our Gitea registry. Built and pushed by: sunbeam build <target>
-  # imagePullPolicy: Always in values-pingora.yaml ensures each rollout pulls fresh.
-  - name: sunbeam-proxy
-    newName: src.DOMAIN_SUFFIX/studio/sunbeam-proxy
-    newTag: latest
-
   # La Gaufre v2 integration service — lagaufre.js widget + SVG logos + nginx
   - name: integration
     newName: src.DOMAIN_SUFFIX/studio/integration
@@ -50,6 +43,14 @@ images:
   - name: lasuite/impress-y-provider
     newName: src.DOMAIN_SUFFIX/studio/impress-y-provider
 
+  # Meet — built from source and pushed to Gitea registry.
+  - name: meet-backend
+    newName: src.DOMAIN_SUFFIX/studio/meet-backend
+    newTag: latest
+  - name: meet-frontend
+    newName: src.DOMAIN_SUFFIX/studio/meet-frontend
+    newTag: latest
+
 patches:
   # Disable SSL verification for OIDC server-side calls — mkcert CA not trusted in pods
   - path: patch-oidc-verify-ssl.yaml
@@ -57,7 +58,7 @@ patches:
       kind: ConfigMap
       name: lasuite-oidc-provider
 
-  # Add hostPort for TURN relay range on Lima VM
+  # Add hostPort for TURN relay range + bind :80/:443 on Lima VM
   - path: values-pingora.yaml
     target:
       kind: Deployment
@@ -69,8 +70,11 @@ patches:
       kind: Service
       name: livekit-server-turn
 
-  # Rewrite hardcoded production integration URL in people-frontend static build
-  - path: patch-people-frontend-nginx.yaml
+  # Set SSL_CERT_FILE so Gitea's Go TLS trusts the mkcert wildcard CA for OIDC calls
+  - path: patch-gitea-mkcert-ca.yaml
+    target:
+      kind: Deployment
+      name: gitea
 
   # Apply §10.7 memory limits to all Deployments
   - path: values-resources.yaml

overlays/local/patch-gitea-mkcert-ca.yaml

@@ -0,0 +1,13 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea
+  namespace: devtools
+spec:
+  template:
+    spec:
+      containers:
+        - name: gitea
+          env:
+            - name: SSL_CERT_FILE
+              value: /run/ca/ca.crt

overlays/local/patch-people-frontend-nginx.yaml

@@ -1,20 +0,0 @@
-# Patch: mount the nginx ConfigMap into people-frontend to rewrite the
-# hardcoded production integration URL at serve time.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: people-frontend
-  namespace: lasuite
-spec:
-  template:
-    spec:
-      containers:
-        - name: desk
-          volumeMounts:
-            - name: nginx-conf
-              mountPath: /etc/nginx/conf.d/default.conf
-              subPath: default.conf
-      volumes:
-        - name: nginx-conf
-          configMap:
-            name: people-frontend-nginx-conf

overlays/local/people-frontend-nginx-configmap.yaml

@@ -1,46 +0,0 @@
-# nginx config for people-frontend that rewrites the hardcoded production
-# integration URL baked into the desk static Next.js build.
-#
-# The people-frontend image has integration.lasuite.numerique.gouv.fr compiled
-# in.  sub_filter rewrites it to our local instance so the gaufre.js and
-# services.json come from integration.DOMAIN_SUFFIX instead of the official
-# government service.
-#
-# gzip must be off for sub_filter to operate on JS responses.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: people-frontend-nginx-conf
-  namespace: lasuite
-data:
-  default.conf: |
-    server {
-      listen 3000;
-      listen 8080;
-      server_name localhost;
-      server_tokens off;
-
-      root /usr/share/nginx/html;
-
-      gzip off;
-      sub_filter 'integration.lasuite.numerique.gouv.fr' 'integration.DOMAIN_SUFFIX';
-      sub_filter_once off;
-      sub_filter_types text/html application/javascript;
-
-      location / {
-          try_files $uri index.html $uri/ =404;
-      }
-
-      location /teams/ {
-        error_page 404 /teams/[id]/;
-      }
-
-      location /mail-domains/ {
-        error_page 404 /mail-domains/[slug]/;
-      }
-
-      error_page 404 /404.html;
-      location = /404.html {
-          internal;
-      }
-    }

overlays/local/values-ory.yaml

@@ -1,27 +0,0 @@
-# Patch: Ory redirect URIs → sslip.io hostnames for local dev.
-# Applied as a strategic merge patch over the rendered Kratos/Hydra ConfigMaps.
-#
-# DOMAIN_SUFFIX is substituted by local-up.sh at deploy time.
-# Production overlay uses sunbeam.pt.
-
-# Kratos selfservice URLs
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kratos-config
-  namespace: ory
-data:
-  selfservice.default_browser_return_url: "https://auth.DOMAIN_SUFFIX/"
-  selfservice.flows.login.ui_url: "https://auth.DOMAIN_SUFFIX/login"
-  selfservice.flows.registration.ui_url: "https://auth.DOMAIN_SUFFIX/registration"
-  selfservice.flows.recovery.ui_url: "https://auth.DOMAIN_SUFFIX/recovery"
-  selfservice.flows.settings.ui_url: "https://auth.DOMAIN_SUFFIX/settings"
-  selfservice.allowed_return_urls: |
-    - https://auth.DOMAIN_SUFFIX/
-    - https://docs.DOMAIN_SUFFIX/
-    - https://meet.DOMAIN_SUFFIX/
-    - https://drive.DOMAIN_SUFFIX/
-    - https://mail.DOMAIN_SUFFIX/
-    - https://chat.DOMAIN_SUFFIX/
-    - https://people.DOMAIN_SUFFIX/
-    - https://src.DOMAIN_SUFFIX/