feat(gateway-api): ADR-060 Fase 1.1 — chart a HTTPRoute (Traefik + Gateway API)

Sincronizado desde repo IDP templates/ (CHART-SYNC-IDP-GITEA-DRIFT). Reemplaza el
Ingress (rke2-ingress-nginx, EOL marzo 2026) por HTTPRoute (Gateway API) adjunto al
Gateway tenant-gateway que crea stack-deployer (§3c). NetworkPolicy egress kube-system
-> traefik-system. FQDN DOT (ADR-082) preservado.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

helm/APP_NAME/templates/httproute.yaml

@@ -0,0 +1,34 @@
+{{- if .Values.httpRoute.enabled }}
+# HTTPRoute (gateway.networking.k8s.io/v1) — ADR-060 Fase 1.
+# El cluster tenant usa Traefik Proxy + Gateway API (reemplaza rke2-ingress-nginx,
+# EOL marzo 2026). El recurso `Gateway` `tenant-gateway` (ns apps) lo crea
+# stack-deployer por tenant (ADR-060 D7 / §3c de su spec); este HTTPRoute se le
+# adjunta vía parentRefs. Paridad con el shape web-backend/python.
+#
+# Lo que NO vive aquí (separación de capas — ADR-060 D6):
+#  - TLS: lo termina el listener HTTPS del Gateway (Secret `tenant-wildcard-tls`,
+#    cert-manager local, ADR-060 Fase 2). El HTTPRoute solo declara el hostname.
+#  - force-ssl-redirect: config global de Traefik Proxy (ports.web.redirectTo).
+#  - proxy-body-size: config global de Traefik / Middleware si se necesita.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+spec:
+  parentRefs:
+    - name: {{ .Values.httpRoute.gatewayName | default "tenant-gateway" }}
+      namespace: {{ .Release.Namespace }}
+      sectionName: https
+  hostnames:
+    - {{ .Values.httpRoute.host | quote }}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: {{ .Release.Name }}
+          port: {{ .Values.service.port }}
+{{- end }}