chore(headlamp): remove routing and legacy auth

[xnoto]

Summary

• remove the Headlamp TunnelBinding before deleting the child Application
• remove the legacy Headlamp Dex client now that kubectl uses the dedicated public client
• document the isolated Cloudflare/Dex kubectl path and bootstrap reconciliation boundary
• add a non-secret kubeconfig template that cannot touch unrelated prod/staging contexts

Safety

The Headlamp Application, namespace, chart resources, finalizer, and shared encrypted client secret remain in this phase. After merge, gitops-operators should prune only the TunnelBinding. The ArgoCD CR is outside the active Application paths and will be applied separately after route removal is verified.

Validation

• kustomize build bootstrap
• kustomize build --enable-alpha-plugins --enable-exec operators
• kustomize build workloads/apps
• pre-commit run --all-files
• server-side dry-run of bootstrap/argocd-config.yaml against Make IT Work k3s
• live kubectl OIDC verification with aud=kubectl, email, admin group, and cluster-admin authorization