feat: expose admin APIs behind OIDC auth_request

Adds pingora routes for id, hydra, search, vault subdomains.
Each gated by auth_request to Hydra userinfo — only valid SSO
bearer tokens pass through. Adds new SANs to the TLS certificate.

overlays/production/cert-manager.yaml

@@ -72,3 +72,8 @@ spec:
     - livekit.DOMAIN_SUFFIX
     - cal.DOMAIN_SUFFIX
     - projects.DOMAIN_SUFFIX
+    - id.DOMAIN_SUFFIX
+    - hydra.DOMAIN_SUFFIX
+    - search.DOMAIN_SUFFIX
+    - vault.DOMAIN_SUFFIX
+    - find.DOMAIN_SUFFIX