fix(pangolin): Reconnect controller to fresh Postgres Pangolin, route via internal API port 3001

DEV-452. After the SQLite -> Postgres migration in DEV-451 the pangolin
initial setup was redone, so the controller's stale bearer token was
invalid. That was only half the problem: /api/v1/traefik-config is
served exclusively by Pangolin's internal API (port 3001), not the
external dashboard API (port 3000). Pointing a Bearer request at port
3000 always returned 401 because that path lives on the session-auth
router. This has been the underlying cause of the controller's
CrashLoopBackOff, not just the stale key.

Changes:
- pangolin-controller-api-key-sealed.yaml: reseal new bearer token
  (kubeseal against sealed-secrets-controller in kube-system, includes
  the Bearer prefix expected by the controller).
- pangolin-controller-config.yaml: CONFIG_ENDPOINT now targets
  http://pangolin.pangolin.svc.cluster.local:3001/api/v1/traefik-config.
- pangolin-deployment.yaml: Service now exposes port 3001 as the
  "internal" port so in-cluster clients (kube-controller) can reach it.
  Ingress still only routes / and /api to ports 3002/3000; port 3001
  is not published to the internet.
- pangolin-controller-deployment.yaml: replicas back to 1, dropped the
  temporary "scaled to 0" comment block.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/pangolin/pangolin-controller-api-key-sealed.yaml

@@ -7,7 +7,7 @@ metadata:
   namespace: pangolin
 spec:
   encryptedData:
-    auth-header: AgBl52zzaXPKKU8RGWux+Rtlk1Z6jQX53psMs1Ypody6iQjgc3yc4Qg4yhLQPaa327JlpbUaXl0oDr+0lN7OPczgtLgWImcC8hDdr2aZ108636jk762fJBJc+iuh2uHPf9Jmu8/5Hie1Y7T5O4GKkjByJNWIO83Seeo64lYpXfggIeTWp/JdpiBWZFOHfJGt41TJlOptw6+CLVtF9GanEBb38LQq0UdTx15Nfc+FmFEcxy8xQZewWlk7V6NaY8Eck/hrhzLWGkdcnItbJNGIB2VqUSW56GcCEDRxkDYRJ/rNQ1brJyCRLCGwPp8jlQpQ0o4ecPhRk55lawtSFz2kNSyRbOdJwCskR101eIhoBAjgfRXEd0ek2+9TIDApobj0TsXd1P/r2xoWRmfmTikEtZmBlbZT5JaS2DnNyWFWyLMBJdbcofsTYorudzPg5WfJfCYXhbOAB8Di9bIhxGEUTcRg2FRNdo1msQ8T5hRH7vHFDLAxovAdm/NZeNv+1q/2+h1Vi/bOGtZoDMuM7aMM6kmishd6jUDElIVpR9lIIRif6dMVfCOHjL0wEPqH60bylE0kKn9pi9ERXANpODVBP+pPHstI67S1+mKvg2/3jSc8n+9DYAmJitYUUw0DDUM6EAuRGOI9FgybzOP2gIPZ2qeWSGx6IWLDNcXqF+w4xyEGR3/iEeKDOoW3dFxlgnUVbZ2QzPQ+OXGpEkXJ8IYQVPV0XZWMj/5/ZPEKo3nUZF7m/PbDyrZjwFLKL5AN4WJ7pBhS0n3uxvYyR6Zh7h6LVJE=
+    auth-header: AgAqHAbAjJG5d8mY1sNkVamnWsl/xdxjthiUWaEd7mXMMHAF9hr+Opy6cIH5BerrU9wtS73YA7be3Xjz8cGFy8LdQvldIBVYzOsA/VTlwMKDoet8bO5eoGEH91Gz7haBBWJvezmeNNxkH7bGlHPvly7+JY8whx9XJWY/hKb6uH2j4fnbSkkL68WobsxbZeJikvLFQrQIxlH0nRc2se4bM+LWJKukiSlWx00qeTGsROvVhxK5tgRMYO4xwPaiEktY9ORHPUYqAmVgdu85d0ygv94XiIFoPSChluVKI9AociynKVb4dQiBbHpKQSsUFBD7US1o1wmgFY8LZCvU9FdbB37VAG5Bxt0VDvOws650NGXLS8CbzidjaBtlpFiJYZRviF2GevIj8UqcmtYFGuvmDMGsGtXOmpkSMiZQyco4lLSWGCwyOYAwEaMNbzzgPbq7VfKJ9efm/rxK7X2t15FCl4jHpI/TC/LobDEBxvK4eELynS5HtcxmwTafYRlp0l1cfTI2yN4ZrsBVsgbCDTZXDjcMuabC6qEjbNrk158KbotkdKFS9mv7Hr3JyrM7PfDQvPtFHUpAzcPESIsElewcwrxGOyLyzYqRPo7wGj9lt4xkQB7OYzlzIP/IxAqzQkiJFv7VU8qCrMVd3VYLn9pbQ71Hv9g+CfuanO1er51Z5s3l9XMA2Zpnoy2uimPkA8svWuIKYcevSH1Gv92zj41jWTy712B9S6w8V7O19Qz6YPBwsezA0EfouDclO0f3Kt4wb0T0QJHHgTBoSjLmC/mFNmQ=
   template:
     metadata:
       creationTimestamp: null

apps/pangolin/pangolin-controller-config.yaml

@@ -4,7 +4,10 @@ metadata:
   name: pangolin-controller-config
   namespace: pangolin
 data:
-  CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3000/api/v1/traefik-config"
+  # The Traefik dynamic config endpoint lives on Pangolin's internal API port (3001),
+  # not the external dashboard API (3000). The external port serves the session-authenticated
+  # dashboard router which returns 401 for Bearer requests to /api/v1/traefik-config.
+  CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3001/api/v1/traefik-config"
   CONFIG_ALLOW_INSECURE_HTTP: "true"
   TARGET_NAMESPACE: "pangolin"
   ENABLE_LEADER_ELECTION: "true"

apps/pangolin/pangolin-controller-deployment.yaml

@@ -7,12 +7,7 @@ metadata:
     app: pangolin-controller
     component: controller
 spec:
-  # Scaled to 0 after Pangolin DB migration (SQLite -> PostgreSQL, DEV-451):
+  replicas: 1
-  # the fresh Pangolin has no admin user or API key yet, so the controller's
-  # bearer token in pangolin-controller-api-key SealedSecret is invalid.
-  # Re-enable after running Pangolin initial setup and resealing a new key.
-  # Tracked in the follow-up child issue.
-  replicas: 0
   strategy:
     type: Recreate
   selector:

apps/pangolin/pangolin-deployment.yaml

@@ -175,6 +175,12 @@ spec:
     port: 3000
     targetPort: 3000
     protocol: TCP
+  # Internal API (used by pangolin-kube-controller for /api/v1/traefik-config).
+  # This port has no auth by design — never route it through the public Ingress.
+  - name: internal
+    port: 3001
+    targetPort: 3001
+    protocol: TCP
   - name: http
     port: 3002
     targetPort: 3002