fix(knoe-auth): wire Google Workspace login for prole.org

- Add KNOE_AUTH_BASE_URL=https://api.prole.org/auth to knoe-auth
  deployment; LoginController.java defaulted to api.0.knoe.dev causing
  redirect_uri mismatch on every Google login attempt

- Update oauth2-proxy-deployment-prole.yaml to reflect live config:
  --provider=oidc --oidc-issuer-url=https://api.prole.org/auth (was
  stale --provider=google; live deployment already switched to OIDC)

- Fix redirect URIs in knoe-auth-google-prole-secret.example.yaml:
  remove spurious double /auth/auth/ prefix (Kong strip_path=false so
  Spring @RequestMapping(/auth) gives /auth/callback/google not
  /auth/auth/callback/google)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml

@@ -196,9 +196,14 @@ spec:
                   name: knoe-auth-google-oidc
                   key: hosted_domain
                   optional: true   # blank = any Google account; set to restrict to Workspace domain
+            # ── prole.org base URL (used for Google OAuth2 redirect_uri) ────────
+            # LoginController.java: @Value("${KNOE_AUTH_BASE_URL:https://api.0.knoe.dev/auth}")
+            # Must be set to the public-facing auth prefix for this cluster.
+            - name: KNOE_AUTH_BASE_URL
+              value: "https://api.prole.org/auth"
             # ── prole.org Google OAuth2 login (Path A) ───────────────────────
             # Real values: bao/kv/knoe/oauth2/google-prole-org
-            # Secret template: deploy/opentofu/k3s/manifests/knoe/knoe-auth-http-keytab-secret.example.yaml
+            # Secret template: deploy/opentofu/k3s/manifests/knoe/knoe-auth-google-prole-secret.example.yaml
             - name: GOOGLE_PROLE_CLIENT_ID
               valueFrom:
                 secretKeyRef:

deploy/opentofu/k3s/manifests/knoe/knoe-auth-google-prole-secret.example.yaml

@@ -11,8 +11,8 @@ metadata:
 #      https://console.cloud.google.com/apis/credentials
 #    Application type: Web application
 #    Authorized redirect URIs:
-#      https://api.prole.org/auth/auth/callback/google
-#      https://api.prole.org/auth/auth/enroll/google-callback
+#      https://api.prole.org/auth/callback/google
+#      https://api.prole.org/auth/enroll/google-callback
 #
 # 2. Store real values in OpenBao:
 #      bao kv put knoe/oauth2/google-prole-org \

deploy/opentofu/k3s/manifests/knoe/oauth2-proxy-deployment-prole.yaml

@@ -80,7 +80,11 @@ spec:
           image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2
           imagePullPolicy: IfNotPresent
           args:
-            - --provider=google
+            # Switched from --provider=google to OIDC via knoe-auth (Phase 2).
+            # Authentication flow: oauth2-proxy → knoe-auth /authorize → Google → knoe-auth /callback/google → oauth2-proxy /callback
+            # The db-prole-org Google OAuth client (https://db.prole.org/oauth2/callback) is now unused.
+            - --provider=oidc
+            - --oidc-issuer-url=https://api.prole.org/auth
             - --email-domain=prole.org
             - --upstream=http://supabase-kong:8000
             - --http-address=0.0.0.0:4180