feat(kratos): deploy Ory Kratos to production (Apple-only OIDC)

Auth was structurally broken — the api's Kratos middleware was pointing
at http://kratos:4433 but Kratos wasn't deployed. The only thing keeping
users logged in was a 5-min Redis cache; once it expired the middleware
called Whoami → no DNS → 401 → forced relogin with no path back.

This commit deploys Kratos for real:

Manifests:
  - kratos.yaml + migrate-job.yaml: pin oryd/kratos:v26.2.0@sha256:92eedc...
    (CalVer current stable as of 2026-06-03)
  - configmap.yaml: drop Google OIDC provider (not in scope); fill the
    Apple provider with real Services ID / Team ID / Key ID — Apple now
    sits at providers[0]
  - kratos.yaml: drop the Google-secret env binding; rebind APPLE_PRIVATE_KEY
    to PROVIDERS_0_APPLE_PRIVATE_KEY (shifted from index 1)
  - network-policies.yaml: add a kratos egress rule to allow-egress-from-api.
    Without this, even with kratos running, the api gets "connection refused"
    on http://kratos:4433 (post-DNAT NetworkPolicy enforcement — runbook §9.2).

Operator prerequisites that were completed alongside this commit:
  - Neon kratos database created (separate from honeyDue, owner neondb_owner)
  - Cloudflare DNS for auth.myhoneydue.com (3 A records, proxied)
  - kratos: block added to config.yaml (gitignored): DSN to the Neon DIRECT
    endpoint, cookie + cipher secrets generated, Fastmail SMTPS URI,
    .p8 contents inline

Out of scope intentionally:
  - Google sign-in (additive; can append providers[] later)
  - Migrating existing auth_user rows onto Kratos identities — pre-prod;
    existing users will need to sign in fresh, which creates a new Kratos
    identity and a new local user row (per migration plan in
    manifests/kratos/README.md).

Verified end-to-end:
  - 338 schema migrations applied successfully
  - 2/2 kratos pods Ready
  - api → kratos:4433/sessions/whoami returns 401 for invalid token (was
    "connection refused" before this commit's NetworkPolicy patch)
  - auth.myhoneydue.com resolves through CF; cloudflare-only middleware
    keeps the origin protected exactly like the other hostnames

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

deploy-k3s/manifests/kratos/kratos.yaml

@@ -1,14 +1,17 @@
 # Ory Kratos — identity service for honeyDue.
 #
-# Deployed only once the operator has completed the prerequisites in
-# kratos/README.md (Neon `kratos` database, auth.myhoneydue.com DNS, Apple +
-# Google OAuth apps, and the kratos-secrets Secret). Until then 03-deploy.sh
-# skips the Kratos apply, so the existing stack is unaffected.
+# Deployed once the operator has completed the prerequisites in kratos/README.md
+# (Neon `kratos` database, auth.myhoneydue.com DNS, Apple Sign In OIDC client,
+# and the kratos-secrets Secret). Until then 03-deploy.sh skips the Kratos
+# apply, so the existing stack is unaffected.
 #
-# IMAGE: oryd/kratos uses CalVer (v25.x / v26.x). The tag below is a
-# fail-loud placeholder — set the current stable tag and pin a @sha256:
-# digest (like redis/vmagent) before deploying. See kratos/README.md.
-# The schema-migration Job is in migrate-job.yaml (run before this).
+# IMAGE: pinned to oryd/kratos v26.2.0 (CalVer current stable as of 2026-06-03)
+# with the linux/amd64 digest. The schema-migration Job is in migrate-job.yaml
+# and runs before this Deployment rolls.
+#
+# OIDC: currently Apple-only (configmap.yaml providers[0]). Google was scoped
+# out at deploy time; adding it later is additive — append to providers[] in
+# configmap.yaml and add the matching CLIENT_SECRET env binding here.
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -41,7 +44,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: kratos
-          image: oryd/kratos:REPLACE_WITH_CURRENT_STABLE_TAG
+          image: oryd/kratos:v26.2.0@sha256:92eedc292ff8e1a918ac442c88ed0abe44610c75121700963114549908a45ac3
           imagePullPolicy: IfNotPresent
           args:
             - serve
@@ -65,10 +68,8 @@ spec:
             - name: COURIER_SMTP_CONNECTION_URI
               valueFrom: { secretKeyRef: { name: kratos-secrets, key: smtp_connection_uri } }
             # OIDC provider secrets — index must match the providers list
-            # order in configmap.yaml (0 = google, 1 = apple).
-            - name: SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS_0_CLIENT_SECRET
-              valueFrom: { secretKeyRef: { name: kratos-secrets, key: google_client_secret } }
-            - name: SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS_1_APPLE_PRIVATE_KEY
+            # order in configmap.yaml. Apple-only for now (index 0).
+            - name: SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS_0_APPLE_PRIVATE_KEY
               valueFrom: { secretKeyRef: { name: kratos-secrets, key: apple_private_key } }
           volumeMounts:
             - name: config