feat(lasuite): migrate integration service to La Gaufre v2

Replace the inline gaufre.js/nginx.conf ConfigMap approach with a
purpose-built custom image (sunbeam/integration-service) that builds
the lagaufre.js v2 widget from the suitenumerique/integration source
and serves it via nginx.

Changes:
- Rewrite integration-deployment.yaml: custom image, v2 services.json
  format, only actually-deployed services (docs, meet, people)
- Add people-frontend nginx sub_filter overlay to rewrite the hardcoded
  production integration URL baked into the Next.js bundle at build time
- Register integration image in local overlay kustomization

overlays/local/kustomization.yaml

@@ -12,6 +12,7 @@ kind: Kustomization
 # replace DOMAIN_SUFFIX with <LIMA_IP>.sslip.io before kubectl apply.
 
 resources:
+  - people-frontend-nginx-configmap.yaml
   - ../../base/ingress
   - ../../base/ory
   - ../../base/data
@@ -22,12 +23,17 @@ resources:
   - ../../base/vso
 
 images:
-  # Pulled from our Gitea registry. Built and pushed by: sunbeam.py --build
+  # Pulled from our Gitea registry. Built and pushed by: sunbeam build <target>
   # imagePullPolicy: Always in values-pingora.yaml ensures each rollout pulls fresh.
   - name: sunbeam-proxy
     newName: src.DOMAIN_SUFFIX/studio/sunbeam-proxy
     newTag: latest
 
+  # La Gaufre v2 integration service — lagaufre.js widget + SVG logos + nginx
+  - name: integration
+    newName: src.DOMAIN_SUFFIX/studio/integration
+    newTag: latest
+
   # amd64-only La Suite images — mirrored to our Gitea registry with a patched
   # OCI index that adds an arm64 alias so Rosetta can run them on the Lima VM.
   # DOMAIN_SUFFIX is substituted by local-up.py at deploy time (sed replacement).
@@ -63,5 +69,8 @@ patches:
       kind: Service
       name: livekit-server-turn
 
+  # Rewrite hardcoded production integration URL in people-frontend static build
+  - path: patch-people-frontend-nginx.yaml
+
   # Apply §10.7 memory limits to all Deployments
   - path: values-resources.yaml

overlays/local/patch-people-frontend-nginx.yaml

@@ -0,0 +1,20 @@
+# Patch: mount the nginx ConfigMap into people-frontend to rewrite the
+# hardcoded production integration URL at serve time.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: people-frontend
+  namespace: lasuite
+spec:
+  template:
+    spec:
+      containers:
+        - name: desk
+          volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/conf.d/default.conf
+              subPath: default.conf
+      volumes:
+        - name: nginx-conf
+          configMap:
+            name: people-frontend-nginx-conf

overlays/local/people-frontend-nginx-configmap.yaml

@@ -0,0 +1,46 @@
+# nginx config for people-frontend that rewrites the hardcoded production
+# integration URL baked into the desk static Next.js build.
+#
+# The people-frontend image has integration.lasuite.numerique.gouv.fr compiled
+# in.  sub_filter rewrites it to our local instance so the gaufre.js and
+# services.json come from integration.DOMAIN_SUFFIX instead of the official
+# government service.
+#
+# gzip must be off for sub_filter to operate on JS responses.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: people-frontend-nginx-conf
+  namespace: lasuite
+data:
+  default.conf: |
+    server {
+      listen 3000;
+      listen 8080;
+      server_name localhost;
+      server_tokens off;
+
+      root /usr/share/nginx/html;
+
+      gzip off;
+      sub_filter 'integration.lasuite.numerique.gouv.fr' 'integration.DOMAIN_SUFFIX';
+      sub_filter_once off;
+      sub_filter_types text/html application/javascript;
+
+      location / {
+          try_files $uri index.html $uri/ =404;
+      }
+
+      location /teams/ {
+        error_page 404 /teams/[id]/;
+      }
+
+      location /mail-domains/ {
+        error_page 404 /mail-domains/[slug]/;
+      }
+
+      error_page 404 /404.html;
+      location = /404.html {
+          internal;
+      }
+    }