Move browser authentication behind a generated-contract BFF

tests/kind/run-deployment.sh

@@ -138,6 +138,8 @@ create_external_secrets() {
   kube --namespace "$FIXTURE_NAMESPACE" delete \
     secret/remora-database \
     secret/remora-coordination \
+    secret/remora-web-oidc \
+    secret/remora-web-session \
     secret/remora-target \
     --ignore-not-found \
     --wait=true
@@ -145,6 +147,10 @@ create_external_secrets() {
     --from-literal="url=$database_url"
   kube --namespace "$FIXTURE_NAMESPACE" create secret generic remora-coordination \
     --from-literal="url=$coordination_url"
+  kube --namespace "$FIXTURE_NAMESPACE" create secret generic remora-web-oidc \
+    --from-literal="client-secret=synthetic-web-client-secret"
+  kube --namespace "$FIXTURE_NAMESPACE" create secret generic remora-web-session \
+    --from-literal="url=$coordination_url"
   kube --namespace "$FIXTURE_NAMESPACE" create secret generic remora-target \
     --from-literal="access-key=$target_access_key" \
     --from-literal="secret-key=$target_secret_key"
@@ -181,9 +187,7 @@ worker:
 web:
   image: {repository: remora-web, tag: local, digest: "", pullPolicy: Never}
   publicOrigin: $public_origin
-  apiUrl: /v1/
   oidcClientId: remora-web
-  cspConnectSrc: "'self' $oidc_issuer"
 podDnsPolicy: None
 podDnsConfig:
   nameservers: [10.96.0.53]
@@ -227,6 +231,9 @@ networkPolicy:
     - fixture.remora.dev/component: vault
     - fixture.remora.dev/component: zitadel
     - fixture.remora.dev/component: versitygw
+  webDependencyPodLabels:
+    - fixture.remora.dev/component: dragonfly
+    - fixture.remora.dev/component: zitadel
 observability:
   serviceMonitor: {enabled: false, interval: 30s}
   prometheusRule: {enabled: false}
@@ -413,6 +420,8 @@ validate_deployment_assets() {
     --set-string outbound.allowedSchemePorts=https:70000
   reject_chart_values "renewal at lease expiry" \
     --set runtime.workerRenewSeconds=30
+  reject_chart_values "a shared WebSession credential" \
+    --set web.sessionUrlSecret.name=remora-coordination
   reject_chart_values "application-only CIDR reachability" \
     --set-string outbound.allowedCidrs=10.0.0.0/8
   reject_chart_values "an impossible disruption budget" \