fix(wiki): the service reads the wiki-index BasicAuth users

#1383 + konairius/Wiki#14 put the wiki's read API behind an OIDC session
or an API key. External agents only have the wiki-index.renner.uno
BasicAuth credentials and got 401 since.

konairius/Wiki (feat/basic-auth-machines) checks `Authorization: Basic`
in the service against the htpasswd lines Traefik uses. This mounts the
existing Secret wiki-api-basic-auth (OpenBao apps/ai/wiki-index-basic-auth,
already the wiki's own) read-only at /var/run/secrets/wiki-basic-auth.
Auth__Basic__UsersPath points at the directory, because the service reads
every key there, as Traefik does. A rotated Secret now also rolls the pod
(reloader annotation).

Order does not matter: the current image ignores the setting, and the new
image without it authenticates nobody over BasicAuth. Traefik's middleware
on wiki-index stays.

kubernetes/apps/wiki/deployment.yaml

@@ -24,7 +24,7 @@ metadata:
   namespace: ai
   annotations:
     # Keys, tokens and the Anthropic key arrive via envFrom; a rotated Secret rolls the pod.
-    secret.reloader.stakater.com/reload: wiki-gitea,wiki-api-keys,wiki-typesafe,wiki-anthropic
+    secret.reloader.stakater.com/reload: wiki-gitea,wiki-api-keys,wiki-typesafe,wiki-anthropic,wiki-api-basic-auth
   labels:
     app.kubernetes.io/name: wiki
 spec:
@@ -77,6 +77,9 @@ spec:
               value: https://auth.renner.uno/application/o/wiki/
             - name: Auth__Oidc__ClientId
               value: wiki
+            # wiki-index BasicAuth users (htpasswd), checked by the service for the read API.
+            - name: Auth__Basic__UsersPath
+              value: /var/run/secrets/wiki-basic-auth
           envFrom:
             - secretRef:
                 name: wiki-gitea
@@ -122,12 +125,18 @@ spec:
               mountPath: /data
             - name: tmp
               mountPath: /tmp
+            - name: basic-auth
+              mountPath: /var/run/secrets/wiki-basic-auth
+              readOnly: true
       volumes:
         - name: data
           persistentVolumeClaim:
             claimName: wiki-data
         - name: tmp
           emptyDir: {}
+        - name: basic-auth
+          secret:
+            secretName: wiki-api-basic-auth
 ---
 apiVersion: v1
 kind: Service

kubernetes/apps/wiki/externalsecrets.yaml

@@ -87,7 +87,7 @@ spec:
         key: apps/ai/wiki-anthropic
         property: api_key
 ---
-# BasicAuth users for the machine door; same OpenBao key as the Python service used.
+# BasicAuth users for the machine door, read by Traefik and by the service; same OpenBao key as the Python service used.
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:

kubernetes/apps/wiki/ingress.yaml

@@ -27,7 +27,7 @@ spec:
                   number: 8080
 ---
 # wiki-index.renner.uno — the machine door (bin/wiki_rank.py, wiki_ask.py):
-# Traefik BasicAuth in front of the service's API-key check.
+# Traefik BasicAuth; the service checks the same credentials itself.
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata: