fix(network-policies): allow any in-cluster source to reach ingress-nginx

The ingress-default-deny CNP enumerated `ingress`, `apps`, `paperless`
as allowed-from namespaces. Any other namespace's pods (e.g.
audiobookshelf) couldn't reach ingress-nginx in-cluster — surfaced
while verifying the k8s_gateway DNS fix: ABS resolved auth.renner.uno
to 10.2.40.80 correctly, but TCP connect timed out because the policy
dropped the packet.

Replace the per-namespace allow list with a `cluster` entity match.
Any pod in the cluster can now reach ingress-nginx; external entry is
still bounded by the existing Cloudflare/MetalLB/host-probe paths.
New app namespaces no longer need a policy edit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/infrastructure/network-policies/ingress-isolation.yaml

@@ -88,8 +88,12 @@ spec:
     - toEntities:
         - world
 ---
-# Default deny ingress to ingress namespace from other namespaces
-# Allow from external (Cloudflare/MetalLB) and host (health probes)
+# Default deny ingress to ingress namespace from external sources only.
+# Any in-cluster pod may reach ingress-nginx (required for east-west
+# OIDC flows via k8s_gateway — audiobookshelf → Authentik etc.); we
+# don't enumerate namespaces, which would require policy edits every
+# time a new app lands. External entry is still bounded by the
+# Cloudflare-proxied / MetalLB / host probe paths.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -98,16 +102,8 @@ metadata:
 spec:
   endpointSelector: {}
   ingress:
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": ingress
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": apps
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": paperless
     - fromEntities:
+        - cluster
         - host
         - remote-node
         - world