Expose Authentik through staging HTTPS

apps/authentik/values.yaml

@@ -89,10 +89,21 @@ authentik:
       limits:
         cpu: "2"
         memory: 2Gi
-    # Test through kubectl port-forward first. Ingress is enabled only after
+    # Route the LAN hostname through the cluster's shared ingress-nginx IP.
-    # the clone is verified and the final source snapshot has been restored.
+    # Prove DNS-01 issuance against Let's Encrypt staging first; switch this
+    # annotation to letsencrypt-prod only after the staging Certificate is
+    # Ready and HTTPS routing has been tested.
     ingress:
-      enabled: false
+      enabled: true
+      ingressClassName: nginx
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt-staging
+      hosts:
+        - auth.ahmza.com
+      tls:
+        - secretName: authentik-tls
+          hosts:
+            - auth.ahmza.com
 
   worker:
     # Workers run scheduled jobs, source synchronization, and other background