traefik: fix bouncer middleware attachment (schema-invalid key)

PR #77 used ports.websecure.middlewares, which chart 40.x's values schema rejects ('additional properties middlewares not allowed'), so the whole Helm upgrade failed and degraded the infrastructure kustomization. Attach the entrypoint default middleware via additionalArguments CLI flag instead (schema-free). experimental.plugins was fine and is unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

kubernetes/infrastructure/traefik/helmrelease.yaml

@@ -53,6 +53,12 @@ spec:
         bouncer:
           moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
           version: v1.6.0
+    # Attach the CrowdSec bouncer to every router on the websecure
+    # entrypoint (global enforcement). The chart's values schema (40.x) has
+    # no `ports.<ep>.middlewares` key, so set the entrypoint default
+    # middleware via static config CLI flag instead.
+    additionalArguments:
+      - "--entryPoints.websecure.http.middlewares=ingress-crowdsec-bouncer@kubernetescrd"
     ingressClass:
       enabled: true
       isDefaultClass: false
@@ -83,12 +89,6 @@ spec:
               scheme: https
               permanent: true
       websecure:
-        # Apply the CrowdSec bouncer to every router on this entrypoint —
-        # global enforcement, like the old ingress-nginx Lua bouncer. The
-        # Middleware itself is fail-open (see crowdsec-middleware.yaml), so
-        # a CrowdSec/LAPI outage never black-holes ingress.
-        middlewares:
-          - ingress-crowdsec-bouncer@kubernetescrd
         # HTTP/3 is the headline reason for this migration — ingress-nginx
         # cannot serve QUIC on UDP/443, so LAN clients that learned the
         # `alpn=h3` hint (DNS HTTPS RR / Alt-Svc) over Cloudflare get