fix(ory): configure Kratos oauth2 provider, session cookie domain, and flows

- Add oauth2_provider.url pointing to hydra-admin so login_challenge
  params are accepted (fixes People OIDC login flow)
- Scope session cookie to parent DOMAIN_SUFFIX so admin.* subdomains
  share the session (fixes redirect loop on kratos-admin-ui)
- Add allowed_return_urls for admin.*, enable recovery flow, add error
  and recovery ui_url entries
- Fix KRATOS_PUBLIC_URL port in login-ui deployment (4433 → 80)

base/ory/login-ui-deployment.yaml

@@ -22,7 +22,7 @@ spec:
               protocol: TCP
           env:
             - name: KRATOS_PUBLIC_URL
-              value: "http://kratos-public.ory.svc.cluster.local:4433"
+              value: "http://kratos-public.ory.svc.cluster.local:80"
             - name: KRATOS_BROWSER_URL
               value: "https://auth.DOMAIN_SUFFIX/kratos"
             - name: HYDRA_ADMIN_URL