feat(wireguard): self-hosted tunnel to OpenBao, no second LoadBalancer

[nbrieussel]

Summary

Companion PR to IntegratedDynamic/infrastructure#53. Adds a self-hosted WireGuard tunnel so Terraform's vault provider — and, as it turned out, any OIDC-gated web UI behind the shared Gateway — can reach the cluster without the public gateway route. Human OIDC/UI login (services/platform/openbao/config) is untouched, still public.

• New services/platform/wireguard app: init pulls the tunnel server's private key from OpenBao (mirrors every other app's init chart); config runs the server.
• Exposed via a hardened NodePort, not the shared Gateway's LoadBalancer — confirmed live that Scaleway's cloud-controller-manager silently drops non-TCP Service ports when building the LB, so a UDPRoute there was never reachable regardless of Envoy Gateway's own config. Hardened since a raw node IP is a genuinely new entry point: externalTrafficPolicy: Local, an explicit least-privilege NetworkPolicy, and a dedicated node security group (infra repo companion PR — Scaleway's auto-managed default group has zero inbound rules and blocks everything).
• Self-healing address: wg.scalepack.fr, kept pointed at whichever node currently hosts the pod by external-dns's native NodePort + externalTrafficPolicy: Local support — no custom script, same mechanism every other *.scalepack.fr hostname already uses. Survives this cluster's daily destroy/rebuild automatically.
• proxy-gateway sidecar: raw TCP passthrough (SNI/Host untouched) straight into Envoy Gateway's own real Service, discovered at startup via its owning-gateway-name label (new rbac.yaml) rather than hardcoded, since that Service name is auto-generated per Gateway object. Every app behind the Gateway becomes reachable over the tunnel with zero per-app config — this is also what makes OIDC logins work: from every app's point of view, tunnel traffic is indistinguishable from the public path.
• dns sidecar: split-DNS, *.scalepack.fr → the tunnel's own address, everything else forwarded upstream. Pushed to peers via their wg-quick config's DNS setting (infra repo) — scoped to the tunnel interface's own lifetime, nothing to remember to revert when it's down.

Design notes / dead ends ruled out live

• Kernel-level routing (net.ipv4.ip_forward + iptables MASQUERADE) to reach OpenBao's ClusterIP — Kapsule's kubelet won't allowlist that sysctl, and Scaleway's kubelet_args API refuses to widen it for this cluster's k8s version. Replaced with the userspace proxy approach above.
• A dedicated proxyTargets entry per app (tried for both OpenBao and Grafana) — works fine for plain API access (nothing browser-based cares about origins), but silently can't complete an OIDC login: Grafana (and similarly any OIDC client) generates its redirect_uri from one hardcoded root_url, so a login started via a tunnel-specific address/port can never complete there (confirmed live: Grafana's "Missing saved oauth state"). The generic proxy-gateway + dns combination replaces both dedicated entries with one mechanism that covers every current and future app behind the Gateway.

Test plan

• helm lint/helm template clean on every touched chart
• Live end-to-end, repeatedly, across a real cluster rebuild: WireGuard handshake and curl to OpenBao through the tunnel; terraform plan on the infra repo's 05-secrets/openbao/managed through the tunnel; Grafana OIDC login completing through the tunnel (proves the split-DNS + Gateway-passthrough design generalizes, not just an OpenBao special case); OpenBao's Terraform access confirmed working through the same generic proxy-gateway path after removing its dedicated proxy
• Not merging yet — branch used for live iteration/testing, per explicit instruction