feat: integrate tuwunel with Ory SSO, rename chat to messages subdomain

- Add matrix to hydra-maester enabledNamespaces for OAuth2Client CRD
- Update allowed_return_urls and selfservice URLs: chat→messages
- Add Kratos verification flow, employee/external identity schemas
- Extend session lifespan to 30 days with persistent cookies
- Route messages.* to tuwunel via Pingora with WebSocket support
- Replace login-ui with kratos-admin-ui as unified auth frontend
- Update TLS certificate SANs: chat→messages, add monitoring subdomains
- Add tuwunel + La Suite images to production overlay
- Switch DDoS/scanner detection to compiled-in ensemble models (observe_only)

scripts/local-up.sh

@@ -197,7 +197,7 @@ echo "  Auth:    https://auth.${DOMAIN}/"
 echo "  Docs:    https://docs.${DOMAIN}/"
 echo "  Meet:    https://meet.${DOMAIN}/"
 echo "  Drive:   https://drive.${DOMAIN}/"
-echo "  Chat:    https://chat.${DOMAIN}/"
+echo "  Messages: https://messages.${DOMAIN}/"
 echo "  Mail:    https://mail.${DOMAIN}/"
 echo "  People:  https://people.${DOMAIN}/"
 echo "  Gitea:   https://src.${DOMAIN}/"

scripts/local-urls.sh

@@ -18,7 +18,7 @@ echo "  Docs:          https://docs.${BASE}"
 echo "  Meet:          https://meet.${BASE}"
 echo "  Drive:         https://drive.${BASE}"
 echo "  Mail:          https://mail.${BASE}"
-echo "  Chat:          https://chat.${BASE}"
+echo "  Messages:      https://messages.${BASE}"
 echo "  People:        https://people.${BASE}"
 echo "  Source:        https://src.${BASE}"
 echo "  Auth:          https://auth.${BASE}"