feat: integrate tuwunel with Ory SSO, rename chat to messages subdomain

- Add matrix to hydra-maester enabledNamespaces for OAuth2Client CRD
- Update allowed_return_urls and selfservice URLs: chat→messages
- Add Kratos verification flow, employee/external identity schemas
- Extend session lifespan to 30 days with persistent cookies
- Route messages.* to tuwunel via Pingora with WebSocket support
- Replace login-ui with kratos-admin-ui as unified auth frontend
- Update TLS certificate SANs: chat→messages, add monitoring subdomains
- Add tuwunel + La Suite images to production overlay
- Switch DDoS/scanner detection to compiled-in ensemble models (observe_only)

overlays/production/cert-manager.yaml

@@ -58,12 +58,15 @@ spec:
     - meet.DOMAIN_SUFFIX
     - drive.DOMAIN_SUFFIX
     - mail.DOMAIN_SUFFIX
-    - chat.DOMAIN_SUFFIX
+    - messages.DOMAIN_SUFFIX
     - people.DOMAIN_SUFFIX
     - src.DOMAIN_SUFFIX
     - auth.DOMAIN_SUFFIX
     - s3.DOMAIN_SUFFIX
-    - grafana.DOMAIN_SUFFIX
+    - metrics.DOMAIN_SUFFIX
+    - systemmetrics.DOMAIN_SUFFIX
+    - systemlogs.DOMAIN_SUFFIX
+    - systemtracing.DOMAIN_SUFFIX
     - admin.DOMAIN_SUFFIX
     - integration.DOMAIN_SUFFIX
     - livekit.DOMAIN_SUFFIX

overlays/production/kustomization.yaml

@@ -7,6 +7,7 @@ kind: Kustomization
 #   sunbeam apply --env production --domain yourdomain.com
 
 resources:
+  - ../../base/build
   - ../../base/longhorn
   - ../../base/cert-manager
   - ../../base/ingress
@@ -18,6 +19,7 @@ resources:
   - ../../base/devtools
   - ../../base/vso
   - ../../base/monitoring
+  - ../../base/matrix
   # cert-manager ClusterIssuer + Certificate (requires cert-manager to be installed)
   - cert-manager.yaml
   # CNPG daily backup schedule
@@ -37,6 +39,36 @@ images:
     newName: src.DOMAIN_SUFFIX/studio/meet-frontend
     newTag: latest
 
+  # people-frontend — built from source with estudio theme baked in.
+  - name: lasuite/people-frontend
+    newName: src.DOMAIN_SUFFIX/studio/people-frontend
+    newTag: latest
+
+  # Messages — built from source and pushed to Gitea registry.
+  - name: messages-backend
+    newName: src.DOMAIN_SUFFIX/studio/messages-backend
+    newTag: latest
+  - name: messages-frontend
+    newName: src.DOMAIN_SUFFIX/studio/messages-frontend
+    newTag: latest
+  - name: messages-mta-in
+    newName: src.DOMAIN_SUFFIX/studio/messages-mta-in
+    newTag: latest
+  - name: messages-mta-out
+    newName: src.DOMAIN_SUFFIX/studio/messages-mta-out
+    newTag: latest
+  - name: messages-mpa
+    newName: src.DOMAIN_SUFFIX/studio/messages-mpa
+    newTag: latest
+  - name: messages-socks-proxy
+    newName: src.DOMAIN_SUFFIX/studio/messages-socks-proxy
+    newTag: latest
+
+  # Tuwunel Matrix homeserver — built and pushed by `sunbeam build tuwunel`
+  - name: tuwunel
+    newName: src.DOMAIN_SUFFIX/studio/tuwunel
+    newTag: latest
+
 patches:
   # Pingora host ports — bind :80/:443 to the host network
   - path: patch-pingora-hostport.yaml
@@ -53,5 +85,18 @@ patches:
   # OpenSearch: expand PVC to 50 Gi
   - path: patch-opensearch-storage.yaml
 
+  # Tuwunel: production resource limits and PVC sizing
+  - path: patch-tuwunel.yaml
+
   # SeaweedFS volume: expand PVC to 600 Gi
   - path: patch-seaweedfs-volume-size.yaml
+
+  # MTA-in: bind port 25 to the host for inbound email delivery
+  - patch: |
+      - op: add
+        path: /spec/template/spec/containers/0/ports/0/hostPort
+        value: 25
+    target:
+      kind: Deployment
+      name: messages-mta-in
+      namespace: lasuite