ingress-nginx auth-type/auth-secret/auth-realm trio becomes a Traefik
BasicAuth Middleware. Re-encrypts the SOPS Secret with both `auth`
(nginx convention, kept for safety during transition) and `users`
(Traefik convention) pointing at the same htpasswd content; SOPS file
now uses encrypted_regex so only stringData is encrypted (the rest of
the manifest is plaintext, matching the convention used elsewhere).
This is the last hostname on ingress-nginx. After this lands and
verifies, the controller can be decommissioned.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
