feat(infra): Meet integration, La Suite theming, Pingora SSH + meet routes

Meet: add backend/frontend/celery deployments and services, meet-config
ConfigMap, nginx SPA config, VSO secrets (meet-db-credentials VDS,
meet-django-secret and meet-livekit VSS). Wire oidc-meet OAuth2Client.

La Suite overlay discipline: move people/docs frontend nginx ConfigMaps
and patches from overlays/local to base so both environments share them.
Remove values-ory.yaml (folded into base). Add docs-frontend nginx config
with sub_filter theming. Add local gitea mkcert CA patch.

Pingora: add [ssh] TCP passthrough block (port 22 → Gitea SSH pod) and
split meet route into frontend default + backend paths for /api/, /admin/,
/oidc/, /static/, /__. Remove now-unused values-pingora.yaml from production
overlay (host ports moved to patch-pingora-hostport.yaml).

Update both overlay kustomizations to reference all new resources and
add meet-backend/meet-frontend image entries.

overlays/local/kustomization.yaml

@@ -12,7 +12,6 @@ kind: Kustomization
 # replace DOMAIN_SUFFIX with <LIMA_IP>.sslip.io before kubectl apply.
 
 resources:
-  - people-frontend-nginx-configmap.yaml
   - ../../base/ingress
   - ../../base/ory
   - ../../base/data
@@ -23,12 +22,6 @@ resources:
   - ../../base/vso
 
 images:
-  # Pulled from our Gitea registry. Built and pushed by: sunbeam build <target>
-  # imagePullPolicy: Always in values-pingora.yaml ensures each rollout pulls fresh.
-  - name: sunbeam-proxy
-    newName: src.DOMAIN_SUFFIX/studio/sunbeam-proxy
-    newTag: latest
-
   # La Gaufre v2 integration service — lagaufre.js widget + SVG logos + nginx
   - name: integration
     newName: src.DOMAIN_SUFFIX/studio/integration
@@ -50,6 +43,14 @@ images:
   - name: lasuite/impress-y-provider
     newName: src.DOMAIN_SUFFIX/studio/impress-y-provider
 
+  # Meet — built from source and pushed to Gitea registry.
+  - name: meet-backend
+    newName: src.DOMAIN_SUFFIX/studio/meet-backend
+    newTag: latest
+  - name: meet-frontend
+    newName: src.DOMAIN_SUFFIX/studio/meet-frontend
+    newTag: latest
+
 patches:
   # Disable SSL verification for OIDC server-side calls — mkcert CA not trusted in pods
   - path: patch-oidc-verify-ssl.yaml
@@ -57,7 +58,7 @@ patches:
       kind: ConfigMap
       name: lasuite-oidc-provider
 
-  # Add hostPort for TURN relay range on Lima VM
+  # Add hostPort for TURN relay range + bind :80/:443 on Lima VM
   - path: values-pingora.yaml
     target:
       kind: Deployment
@@ -69,8 +70,11 @@ patches:
       kind: Service
       name: livekit-server-turn
 
-  # Rewrite hardcoded production integration URL in people-frontend static build
-  - path: patch-people-frontend-nginx.yaml
+  # Set SSL_CERT_FILE so Gitea's Go TLS trusts the mkcert wildcard CA for OIDC calls
+  - path: patch-gitea-mkcert-ca.yaml
+    target:
+      kind: Deployment
+      name: gitea
 
   # Apply §10.7 memory limits to all Deployments
   - path: values-resources.yaml