Harden WebBFF and deployment release behavior

Model fail-closed cross-replica session renewal and implement owner-fenced refresh, transient observer handling, logout fencing, and graceful shutdown. Remove chart-owned Ingress while retaining qualification-owned external routing.

deploy/charts/remora/templates/ingress.yaml

@@ -1,39 +0,0 @@
-{{- if .Values.ingress.enabled }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ include "remora.fullname" . }}
-  labels:
-    {{- include "remora.labels" . | nindent 4 }}
-  {{- with .Values.ingress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if .Values.ingress.className }}
-  ingressClassName: {{ .Values.ingress.className }}
-  {{- end }}
-  {{- if .Values.ingress.tlsSecretName }}
-  tls:
-    - hosts: [{{ .Values.ingress.host | quote }}]
-      secretName: {{ .Values.ingress.tlsSecretName }}
-  {{- end }}
-  rules:
-    - host: {{ .Values.ingress.host | quote }}
-      http:
-        paths:
-          - path: /v1
-            pathType: Prefix
-            backend:
-              service:
-                name: {{ include "remora.fullname" . }}
-                port:
-                  name: http
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: {{ include "remora.fullname" . }}-web
-                port:
-                  name: http
-{{- end }}

deploy/charts/remora/values.schema.json

@@ -18,7 +18,6 @@
     "vault",
     "runtime",
     "outbound",
-    "ingress",
     "networkPolicy",
     "observability",
     "podDisruptionBudget"
@@ -191,21 +190,6 @@
         "maxRedirects": {"type": "integer", "minimum": 0, "maximum": 100}
       }
     },
-    "ingress": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["enabled", "className", "annotations", "host", "tlsSecretName"],
-      "properties": {
-        "enabled": {"type": "boolean"},
-        "className": {"type": "string"},
-        "annotations": {"$ref": "#/$defs/stringMap"},
-        "host": {
-          "type": "string",
-          "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$"
-        },
-        "tlsSecretName": {"type": "string"}
-      }
-    },
     "networkPolicy": {
       "type": "object",
       "additionalProperties": false,

deploy/charts/remora/values.yaml

@@ -124,13 +124,6 @@ outbound:
   allowedCidrs: ""
   maxRedirects: 5
 
-ingress:
-  enabled: false
-  className: ""
-  annotations: {}
-  host: remora.example.com
-  tlsSecretName: ""
-
 networkPolicy:
   enabled: true
   ingressNamespaceSelector: {}